{ "Event": { "published": true, "date": "2021-10-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-16", "timestamp": 1634428982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1eccb017-ddf1-45d3-b6dd-a94e3e92b019", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80e71a8-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393870, "uuid": "475b2d4f-c3d7-4d62-accb-1873502555d9", "comment": "Malware payload (Mirai)", "value": "e10fd6d413a80d4cc3fff4bde111eaef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393870, "uuid": "2de9771d-7d14-4467-b47b-381b2eed8006", "comment": "Malware payload (Mirai)", "value": "00a08536cb8047dc1141457c907787dba7761baaaccb0ea28523833432b140db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393870, "uuid": "35ba8746-5356-403e-9826-82e804d27f0c", "comment": "Malware payload (Mirai)", "value": "7b45dd269bbb89d5c6daf642fbfd6af22100009f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393870, "uuid": "635a9665-9cd6-4665-b388-c986d8c7d6f0", "comment": "Malware payload (Mirai)", "value": "4840da96fb1a2a296edadba0a33e7d22782f42012b41fb88331bb28c0dd3f9970470f68aadcc95614d516e15bdde76c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393870, "uuid": "a8e208b0-8560-4884-b156-0f67efb0d0a4", "value": "T1DA338DA1C47D5D50D25842B4A9288F7C5373D909AA9A3FF64286C366D00BFECF1293F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393870, "uuid": "e22324a3-8b8e-47fd-b424-4611d8d231e5", "value": "768:v/ioz1BuLJ4Y63WTOariz5qvsHFi2EIojO7gRNZocYyUDiCLx31c:v/TPul4YvTOarcP1PoS0XecaDiCLxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393870, "uuid": "ce11edf7-9d44-4e69-87ad-d9d2a988f3b0", "value": 51460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393870, "uuid": "1fa851d3-0e4a-4879-8d00-07e38b15acf2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393870, "uuid": "1c64da48-5b88-4780-be49-fb9072aa99d0", "value": "e10fd6d413a80d4cc3fff4bde111eaef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81d2a1d-2e27-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350974, "uuid": "f5403f42-d35d-4141-bb16-22c358ef327e", "comment": "Malware payload (Gafgyt)", "value": "e6f590ac86a1ff1eec16c3df28b8d95a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350974, "uuid": "f33403a6-a4c7-431e-87e2-719d096d6fd7", "comment": "Malware payload (Gafgyt)", "value": "0303f7a611f428405a8f42dc444397ca27aae95bef356d96d29025e597e949d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350974, "uuid": "b770b876-b05d-41c0-9acc-f15325d290d4", "comment": "Malware payload (Gafgyt)", "value": "2b9e1ac79af2098ff06f9e62ceaaa297872d4c90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350974, "uuid": "384e59a5-6908-403b-adae-b8b665803bd7", "comment": "Malware payload (Gafgyt)", "value": "1c4f842ff8a24a793bfe100b934e5c269e78af92320b1f94685c99cfc7988216850b9dc866018d0f23f60da0aace41dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350974, "uuid": "cb313009-735a-46d9-9a58-1d949de06656", "value": "T159A31896F801EF77F40AD67604D74B20B630BBE20B532626731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350974, "uuid": "45361b62-fdd6-409a-82d5-c99261c8b3d5", "value": "3072:7wlfFFYRIy5qT1TL5SSyQZ8+mWFVqDr7wf21s:7wF3SIy5qTFyQe+mWFVqDr7wf21s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350974, "uuid": "294507fe-7661-4d9b-b4c2-f379cf5b62eb", "value": 101397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350974, "uuid": "bac613da-e60b-41e6-b369-b5229fe56896", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350974, "uuid": "41e80cc9-58da-484e-ad47-dccd2e89f4c8", "value": "e6f590ac86a1ff1eec16c3df28b8d95a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7fad06-2e72-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634383009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383009, "uuid": "a2a6b910-183a-4bc3-8a6e-2ad8fe8a4c0c", "comment": "Malware payload (Mirai)", "value": "22d7d0177604f3e0d9f3b83e0c86ef2b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383009, "uuid": "1b733242-d63d-44db-b402-b3ff3c5aa350", "comment": "Malware payload (Mirai)", "value": "03779c62f2fdfeefe63e470543e2eb73f36f3b8fad3bd4b6baf4d563e1c35c86", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383009, "uuid": "76b8a08b-01aa-4220-858a-3f47c8911fae", "comment": "Malware payload (Mirai)", "value": "658d322aa7acfad0d3215cd5e1c693c9e167b465", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383009, "uuid": "de88cfb3-fd00-4156-bfc2-bf54e89b1a3b", "comment": "Malware payload (Mirai)", "value": "91c8ef20069e3bf7872b61f16c607a6b9b5bfc2fbd8c78c1e4ab97bb3b56185b6af0bb605a08a0459587d46b353f6410", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383009, "uuid": "1d88cb1a-17ed-4437-b87b-1557f37df520", "value": "T1E2634B02B55182FDD446C1709ABFE177E531BE6D22346A1E2BD0BF522E36E71263E384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383009, "uuid": "417f22de-be0c-409a-b590-0863271cf35e", "value": "1536:nY8y1j/XoMAtghuQ2QhqXYKt8t0RV/tlV3lhr:B2wWqXYgfhlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383009, "uuid": "91076363-73ce-41f1-b5cf-80de335165d4", "value": 70320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383009, "uuid": "cab57960-5df1-45ce-b615-32f78c77464b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383009, "uuid": "0e3ec9bf-708c-455c-82c2-b6fc424f408d", "value": "22d7d0177604f3e0d9f3b83e0c86ef2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec05f78-2e8e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634394901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394901, "uuid": "04163033-f740-4594-a4fb-6a125f995cfe", "comment": "Malware payload (RedLineStealer)", "value": "85c2b4dc426a3020849e4e44d6d356f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394901, "uuid": "d87bf979-2913-487f-856e-91f0bc8ff580", "comment": "Malware payload (RedLineStealer)", "value": "0392bf70244ded4e9d61bdb9197864881a4f5c85a8314b675388e54b8080c3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394901, "uuid": "e1c03313-e253-43f3-a112-08a2cf59ff6d", "comment": "Malware payload (RedLineStealer)", "value": "fd02152e31c1650d695ce7b541fb5f6f621dc7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394901, "uuid": "2ded2a5c-7784-4255-a79c-6ddff0546ff5", "comment": "Malware payload (RedLineStealer)", "value": "f92c7cb1ea9e24a1dfb7b3b32f480eb699b3ac5391671374b31f10fe56c9286a5d7486255c8344e97f3b8f9155569208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394901, "uuid": "e1e6a7c7-a79b-411e-a735-bf1c0ad79fef", "value": "T1BE84BF10B7A0C035F5F352F846B59278A63E7AA0A764A4CF52D527EE4A347E1EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394901, "uuid": "ed914a7b-f7e2-492b-9f2f-6d06986ef636", "value": "baf5c2110fa8a268441421686d4e3331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394901, "uuid": "f7b5dc60-5b12-46d2-b187-18330a60e343", "value": "6144:SNsixpSUnmJLee1Mjlua+Eob/XNJN4cIQ5cOfmmGDOwqk3K9GLy:esDWmJL91MluGu/J4cIQ59GywqkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394901, "uuid": "5a2684a2-f77f-4ad1-9586-6ca0d5a6c574", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394901, "uuid": "db2bbcf4-f517-4eb8-b818-4ffef94c09e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394901, "uuid": "c38e57ff-73cb-48dd-9814-daab9f17505b", "value": "85c2b4dc426a3020849e4e44d6d356f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32d62ea-2eac-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634408062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408062, "uuid": "e26817f3-04c7-4c96-b8d7-fba9fddae5e3", "comment": "Malware payload (Cerberus)", "value": "dc51bff95e5440333dbac8b51994a00d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408062, "uuid": "22090a6f-2b84-4757-a1fd-44301e0daa02", "comment": "Malware payload (Cerberus)", "value": "03b8c573cd719e544d027170e25799ffeeb61b3d0ba9827ea0d2248e0a66319d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408062, "uuid": "0c38af69-c1ac-4601-8eb2-b90307a8e99f", "comment": "Malware payload (Cerberus)", "value": "8b491a026b3689e1b3f21af8c6aeaa0ad31055fc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408062, "uuid": "c0a15bb2-a0b2-4208-9a33-ea58e1572222", "comment": "Malware payload (Cerberus)", "value": "cd618e7d9ac098a9ab09e735f43c1b4db8bdc6ff0f3761825d40322b27c888789537c8f214174d81caa6801426f3544e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408062, "uuid": "6f507d69-4229-484c-a0cf-12fc1bf6abfc", "value": "T1CDD533DC17A044ADE237ED7169CB4242B3610F879128029F6DA9BEB098F3D451F9D93D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408062, "uuid": "5f125920-c8e5-4d7d-9179-4059c75ddd61", "value": "49152:iRfAtVRTLJe4S5x8GuzmsMSCGL6kdn6zfwaWNBOsKQwWqr48+73ZeswNP7RhuBVJ:wfAfNLJe4SQGuzsA6kdn6zfPYBONQb77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634408062, "uuid": "5c8c540c-cb63-4f82-b257-45ab3e61cd0a", "value": 2890784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634408062, "uuid": "af536b58-08ec-41d1-87d7-a4b49453bcfb", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408062, "uuid": "4789939a-8075-4ba0-8422-2b7223f59595", "value": "Google_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f5806e-2e6e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634381253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381253, "uuid": "d8ce2ddf-1922-4b7c-97f3-774d53460f7b", "comment": "Malware payload (Gafgyt)", "value": "76aad0dae4132c67c743ee4da57008d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381253, "uuid": "f0fae47c-07b0-4a9f-bf93-2de4133a95ca", "comment": "Malware payload (Gafgyt)", "value": "03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381253, "uuid": "205cec15-12bf-4911-877e-95ddefffef22", "comment": "Malware payload (Gafgyt)", "value": "f5f0d05b4756653e51de21840d24b767ec2d4efd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381253, "uuid": "f083453d-61cd-4b40-ad6d-9ac802320ed0", "comment": "Malware payload (Gafgyt)", "value": "0b88fa34cf4cafb3a7fb48e1c299d91454368abc68ae89627c4ec8d9f669e5058068f6cf486636d8d1bb2927967810dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381253, "uuid": "c3207bde-9c2c-4611-8d4e-03d0ad93e0aa", "value": "T11B930892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381253, "uuid": "43616cfe-5023-41de-9171-c1a8f2cfbb36", "value": "1536:4mZVaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gi62f7vTmQ9VqXjewf2Le:vYp09W6KTG/IB6Yy36PNfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381253, "uuid": "3ddc1891-e3c9-43ed-a7bd-c454f1cdd1f9", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381253, "uuid": "899e65af-1eca-4e8e-9b00-866fbbaec55a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381253, "uuid": "72d46152-ad96-4424-913b-25c4d62afdb6", "value": "76aad0dae4132c67c743ee4da57008d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b54bbac-2e6e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634381232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381232, "uuid": "091b20c4-4756-4882-a260-a23242390378", "comment": "Malware payload (Gafgyt)", "value": "71c92487d9552b1d4aa0f19bc38b3b76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381232, "uuid": "08a82550-652a-42a0-aee3-26f2e9d2df60", "comment": "Malware payload (Gafgyt)", "value": "04396ccec2f5216bf1bccab047615fb59c1b6a4c6ce2cdba2bfe677cf18bcb7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381232, "uuid": "e0e0b1f6-6ef6-4739-be32-8612b72d4bd3", "comment": "Malware payload (Gafgyt)", "value": "564c69faac6cf150f74e2051b2b14dadbced3a31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381232, "uuid": "c2610f5c-f10d-41d6-a4fd-90c2b51e1f34", "comment": "Malware payload (Gafgyt)", "value": "0aeca8a0082e2d0768735b4d0cbb54779a60ee5a9cf259012f7db8bee35c69eeb6ce81e28fcbfff4d1caefd6c0f51495", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381232, "uuid": "ff622236-814a-4453-974e-fc92faa3642b", "value": "T14AA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381232, "uuid": "79a4fada-9359-4a97-97c5-2faa899ac12d", "value": "3072:VSx+i6mqaObhNqnPNKV+qKmZuqQ4DPwXXtse:y6mRObnqnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381232, "uuid": "6cb429aa-0377-4afc-8c7b-fe8ea971a97b", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381232, "uuid": "771b72e1-93b2-43bd-b1d5-3092b07c149c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381232, "uuid": "e44bce6c-b70d-48b3-afe8-2b6a8511ebb7", "value": "71c92487d9552b1d4aa0f19bc38b3b76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038a24d2-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634396090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396090, "uuid": "97406516-1206-4667-9a25-c4877c33e468", "comment": "Malware payload (Mirai)", "value": "654379418afe52a82f7a1fa5f9a60a69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396090, "uuid": "dadc2dae-98ba-4a1e-b97d-932d43cd624f", "comment": "Malware payload (Mirai)", "value": "045117bbfd9acfb9cd7f21525d35ec13e8964153b822a87bec0c16f83b6a6dd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396090, "uuid": "cfa439f7-3894-44e0-b4bf-9e015da81ed8", "comment": "Malware payload (Mirai)", "value": "1cc2ff1f45a06607fdf6cb5c708d9aa63e913fad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396090, "uuid": "27939cd6-3c96-459e-8163-968788ea5c9d", "comment": "Malware payload (Mirai)", "value": "2f877e76b10de59045b8395db4db257ee0702fc80b2a34e5b0e11164e853221ab2b89e9b7c16338088c96ddc7496295f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396090, "uuid": "6350fe4e-e324-4ba6-a259-3d0d53cba6ae", "value": "T1BBE2E122D384FAB7F6608833FF3F4257932C7A7C99B57956531C18880C8B19196795C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396090, "uuid": "6fa7d017-6c7d-44b0-a6ea-7ad8d388b335", "value": "768:wL6zniImBk1F06lbMemx833yDI7Pgejq3UI/7:xziIekj0ZemyHMic/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396090, "uuid": "5800c07e-2568-4bff-9eba-73761ce811cd", "value": 32360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396090, "uuid": "fdce5a9a-f0d2-46d4-b9e3-cc0b24f87c44", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396090, "uuid": "154341ea-0b8c-4bce-a294-c3e16b174366", "value": "654379418afe52a82f7a1fa5f9a60a69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5255e338-2ed1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634423710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634423710, "uuid": "0aaa8f46-73f3-46c5-8252-731742e8b3b7", "comment": "Malware payload (RedLineStealer)", "value": "49b769f67fe09869c271a0c8115e32d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634423710, "uuid": "70204547-88b5-4aee-b04d-6b4a19a47f0d", "comment": "Malware payload (RedLineStealer)", "value": "04925bf3c85303a846bedce6766addc4908e7277bb2e2007d77176cfa16c336d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634423710, "uuid": "61268d8f-c586-49bb-a71c-2c7c98c4bfb0", "comment": "Malware payload (RedLineStealer)", "value": "c8a6ab19fd02ebd01afb0acadf1b2a3d542df356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634423710, "uuid": "b508dd47-1125-4798-a940-148cfb0f0849", "comment": "Malware payload (RedLineStealer)", "value": "c900db831bcf00a7aeef39f8e1b5a66ed141a12fee952e9d23e215df6195506260821f2ccf8e2bfef49ca35bbb41f3ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634423710, "uuid": "3625018b-3573-44de-b7b6-7f61eb5ab529", "value": "T1DC949D10A660C039F5F352F48DFA9369A52E7EE16B2490CB53D51AEE97356E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634423710, "uuid": "b7fe235d-2d72-47f8-a39d-5fc99df48ba1", "value": "578dc7dab5389346cbcc286cae0d11e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634423710, "uuid": "9f694d41-fec0-46dc-82c2-5234ec41efd5", "value": "12288:hN+rnEo0tWvMYNsTO8Qjd++VKXB12Zm3kkm:hNynCYvMY2OuAKXB1mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634423710, "uuid": "c8ff3b5d-02f2-4248-a0d8-5dbad72914bd", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634423710, "uuid": "abcd1e27-7f50-4d93-a398-8b6cb393c7a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634423710, "uuid": "7bcad2f8-fc90-4a1d-a6de-68a3f9cb1db8", "value": "49b769f67fe09869c271a0c8115e32d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0de1265-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350505, "uuid": "db1074c4-afc1-4382-b47d-26c76e1df6c9", "comment": "Malware payload (Gafgyt)", "value": "e626771ef059246972ae8b4ea0df074c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350505, "uuid": "247e9add-0e5f-4161-aae0-82b6d33999e3", "comment": "Malware payload (Gafgyt)", "value": "04e9c6fed70bd3c37fa650edfddb4066c56d4b8cc5b1bf765e7cf2722078bbdf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350505, "uuid": "e95bf525-b85b-4904-b0cd-6091c1668764", "comment": "Malware payload (Gafgyt)", "value": "05a3c34441ca5ddacc54175bf15bc4df94f96e65", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350505, "uuid": "40843f28-5100-40fc-a5ed-861ed69f5bf2", "comment": "Malware payload (Gafgyt)", "value": "8b303648c8e10f88eac7fe2c2ba1de4f293633293e3035652e2b7576060542c13275de1c471366c868af185983db2721", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350505, "uuid": "8e3f2198-8620-4d83-b9a0-454b28afb10e", "value": "T1E8A32927A552C67AC0D762B42FDF8AA19433B4BD0B32320F33E47DA52F259E92D59701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350505, "uuid": "1180f897-0fc8-449c-86da-be2ece263c46", "value": "1536:3dp6YNXvK8GUqiXmLnVePv6pLQuGZQk8NJ3w7gCZzTmo+euOXFse+ZNxs:tfXvK8G0XmRePiupZQk8N5wtTmXeuOXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350505, "uuid": "3d5450ff-aa79-4fbe-8ff8-771ff52adabe", "value": 97737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350505, "uuid": "1793cbf1-33f5-48a9-8c83-34a610a11d17", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350505, "uuid": "78b452e1-da5b-4c5f-b8b6-3f95e1aec07a", "value": "e626771ef059246972ae8b4ea0df074c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fce0a7-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380257, "uuid": "2e12a799-724c-4b51-a390-c0ec738ed9b8", "comment": "Malware payload (Gafgyt)", "value": "dc0cc6a6ed79a3e80217409ae486d963", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380257, "uuid": "c59aa065-a59c-42ba-9d74-9fa86fb2f7a0", "comment": "Malware payload (Gafgyt)", "value": "0564d910de6176b3d1a8c368bc2db48b789a6b018a0f01c136f8176767810569", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380257, "uuid": "287ab10c-b276-4a05-9153-e727371144d0", "comment": "Malware payload (Gafgyt)", "value": "e5f9c518d385a625d2c3c05d5fc2d9117c8fddb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380257, "uuid": "bc30fdb4-a979-4820-87aa-78354d7bce39", "comment": "Malware payload (Gafgyt)", "value": "aa0fbc43e6ae38be87d8f6963bb296226280a90628e42cc3808a5bfad98b1dbf08a401cff97b429ad5a08bfc55133961", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380257, "uuid": "206cf002-aa62-48c6-8b02-56c36ca6f22d", "value": "T161B3842A7E22EFFFE668863107F35F7087D5219226A19385F26CE6181E7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380257, "uuid": "5dd24b2f-5899-4039-8361-094b4f6e3cba", "value": "1536:27ju1Thpq+XvYC2rKy3eY5PGEEeRYYI/8vECRIKmbaUmkiSFxfC7xbXe:RvYJPGEu//F8IKmuUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380257, "uuid": "ec4ae995-bfe0-450a-9024-8dd0acf18c2e", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380257, "uuid": "82c440b9-57eb-439d-8beb-b456612fd2ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380257, "uuid": "a27e636e-6c8d-47d0-a793-f190097da60e", "value": "dc0cc6a6ed79a3e80217409ae486d963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e19d82b-2e49-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634365291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365291, "uuid": "6132fa02-c4bf-43dc-b0b4-876b3d1f3d29", "comment": "Malware payload (Mirai)", "value": "389db186b549d4cf9ef5d71dbcf18462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365291, "uuid": "e18c9ac2-6a4e-48bf-b315-1ff526f41d21", "comment": "Malware payload (Mirai)", "value": "06643e9d401188db0b70e845d71807d790be0bc69e7931cc525554cbf56b3a20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365291, "uuid": "308a2f7d-855c-41d2-ac78-d842c64fc3e9", "comment": "Malware payload (Mirai)", "value": "3dc3385cbb026bc50cbc7cd0c5e6498ee3625011", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365291, "uuid": "1618cc01-2da9-4fb8-b3e2-fcc5abe8088b", "comment": "Malware payload (Mirai)", "value": "2dedfbbe8c180e7104f5ad05a6c8b5cb0c7b345546fe8306b845f1d6e5e4d76c92708d92a7676f358df95d6545fd0858", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365291, "uuid": "db992c79-35d8-4c1f-8ff8-e4068a872b7a", "value": "T162D2E15067A1ECB0DE74473EEF3C4142621713BBF4ECF5E706988A09B64C60BA735686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365291, "uuid": "812b6c3c-7cc8-4ab3-8e02-3b967e142d7f", "value": "768:9FoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZ6s3Uozd:9F2+IoXVeNIlzpzAlzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634365291, "uuid": "b1da55e7-185e-4380-8095-573ff89d14a8", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634365291, "uuid": "67cdb229-ccee-427a-9ce0-c60953d329dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365291, "uuid": "2532e525-d1b6-45dc-8782-2c76703e5ab1", "value": "389db186b549d4cf9ef5d71dbcf18462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674098b4-2e4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634366622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366622, "uuid": "36558df4-1a84-476f-94b8-6219d8be2b1c", "comment": "Malware payload (Mirai)", "value": "c0b3aae335266e083287b1180f6c493a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366622, "uuid": "94ba47bc-6d23-44a1-805c-20f0d9f4cd51", "comment": "Malware payload (Mirai)", "value": "0aebdb6dc3ecf04d43a0ddb0542d781a3f7829babf1f5f27327ee85a54255ef9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366622, "uuid": "dd3faa59-1afd-466c-bfb4-8dd73c377472", "comment": "Malware payload (Mirai)", "value": "d38fe3f25131741bf63caa6f74d2268d23245b9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366622, "uuid": "723102af-c1ea-4559-b25b-2104a7ae8a68", "comment": "Malware payload (Mirai)", "value": "4eadf0e58d8b6b14ac00ee8e2ba87be815cc5025d51305cf5920add2222c72e7e80188268a6d2fe0f6260a7a2370c25d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366622, "uuid": "d3ec26bb-b4fc-4287-9bb0-a52ba7ba3f7b", "value": "T18FC2E125270A9435D3F04078C990C299716E57ACD1EFF2227D440E2CBAA690E75F9E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366622, "uuid": "e8cc9050-4e9a-4058-a471-0eeb24a1a500", "value": "384:qdk751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HAcyPaEhymdGUop5h5Y:qy75KMu5z6sOj4qes3UoznY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634366622, "uuid": "0de2b010-24a1-4ce2-a336-ca269e486137", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634366622, "uuid": "cc576005-c77b-4703-a687-86a95e2b6faa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366622, "uuid": "e43c4ce1-11a8-4176-96f3-b4fe39f8744f", "value": "c0b3aae335266e083287b1180f6c493a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7325208f-2e6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634379956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379956, "uuid": "f0788a28-2013-493a-b1ea-dac5a7ea84fe", "comment": "Malware payload (Mirai)", "value": "ac91a80e0cff0891f61de4fc90b66e6c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379956, "uuid": "55a5875f-526b-46da-ac4d-093078a414a9", "comment": "Malware payload (Mirai)", "value": "0b6275982bd25de44a88ea62c5bd5942fecb2b61ca1f7fa76a143fb76c507d70", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379956, "uuid": "bbf53fd7-4c8f-4016-bfd1-3ae54f0cb4c1", "comment": "Malware payload (Mirai)", "value": "411a2f0ecd8bd6d637e3f432a2d23212c2622c04", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379956, "uuid": "de277587-1c81-4bc9-beb4-ab4f3fe02b5a", "comment": "Malware payload (Mirai)", "value": "2205e3261cea569fba1d3493c06b9b35fc5beeecc6ca15dd70b1067a26d840adcad0e0123fffb7a434f6ae29c69b8182", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379956, "uuid": "bd3b456d-abe0-43ea-8031-0ab1bf328584", "value": "T15C33390BA58181FCC459C27443BBB13AE466357E123DB1EA6BC8FF1B6D45E605E2C8C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379956, "uuid": "6e7f58b2-d085-4d19-8f75-6d2b6596bc72", "value": "1536:q/5RfbZDWNJbfV1eCZ9oAOSwBrdw9dfKTJX7:i5N1DWHfTuBSw7QdSJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379956, "uuid": "b5e33b79-70ab-4077-a108-bb1fb7f157da", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379956, "uuid": "a5a20f0b-3436-408d-9ac4-4cda32cff1cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379956, "uuid": "22780b51-fe86-4252-adb6-aca672f53033", "value": "ac91a80e0cff0891f61de4fc90b66e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5c3df1-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634394660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394660, "uuid": "fb2611d4-7c60-46af-b3fe-9e19c358938b", "comment": "Malware payload (Formbook)", "value": "2c2811633faebf78e7bdefb5e8867faf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394660, "uuid": "ec9a6e56-e01e-40dd-b543-e1ad51ded69d", "comment": "Malware payload (Formbook)", "value": "0c9257ae6c84763746b188ff4d2dc58d040b32f8ab54e9466137312c8e0cc92b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394660, "uuid": "8ea48311-92ba-4b99-a1a9-e5c37903ccb7", "comment": "Malware payload (Formbook)", "value": "c5b01b1cbfc32b1470eacce7ff54d042e18b3e98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394660, "uuid": "6bb095c4-04e3-4d6d-8538-ae284fb74f65", "comment": "Malware payload (Formbook)", "value": "dd2fd5186605b308e699990b7eba94776b99596d1ab2cbbd205e678b3bbad8e4962fc82d689aa479bf8632441bb37fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394660, "uuid": "d1407349-5a81-471f-ad2c-3a0c49d87c25", "value": "T1E7740111539C422ECA765E79143D112D73705E6AF8D1FB8B6B8FF893047A3830E51AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394660, "uuid": "eda3cbfb-8ff9-4534-ae2e-01d690ba5b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394660, "uuid": "fc911745-4387-45fb-bca0-b7307d01ab55", "value": "6144:WfDetGGYMkhBA1pCyFam6afSPJ3tusE3yTgGqU8VozKCBfc5fTCm+xzqAq:WfCthzSBWCsamnfSB3tZEEx8VaKCBojv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394660, "uuid": "160a280f-6e9f-4188-b8a4-9aedef060752", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394660, "uuid": "ba7f0e66-dadf-4fba-83ba-2f0840f42732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394660, "uuid": "b99e5d1b-38df-4993-8669-2c4204143716", "value": "2c2811633faebf78e7bdefb5e8867faf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7c611c-2e4e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634367570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367570, "uuid": "5071fa73-db74-4fde-b9ab-bcef9025390a", "comment": "Malware payload", "value": "e89decc1f703205c7a8f3d7e20dec4ca", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367570, "uuid": "bcf6adc8-f851-4378-9c9f-21b33ff0d259", "comment": "Malware payload", "value": "0e08d797fbc53e6daa76d0961c1dec3063659cbffbb32ef332243f768ce27402", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367570, "uuid": "d31c7d5b-bd1b-41f6-a447-93136b995beb", "comment": "Malware payload", "value": "0204c3761ad22d1cc5827ce3ae7f2a3deb611d2c", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367570, "uuid": "69c5e173-dd45-45a2-a31d-3abbc9ccbd55", "comment": "Malware payload", "value": "fe761c88e17a1378b32fa0c49dc1b17556f28c43b467fbe9e1e44f67c8a961468d8ec04067fab298fb6c80eda39d8487", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367570, "uuid": "b4eec26c-650a-4d22-8620-65ce0efc8928", "value": "T1C205844AE3529D41D59A867350E450E3F70C1C96E4889779AFB3BBE3089E3850B4CBDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367570, "uuid": "96b13c86-76c6-4961-81cb-afae5ba5503e", "value": "12288:yvf3JDIL6tSpW0jtsHEN2LqDE0Pmoxj9svVXkZFFblc:AIIkW0xrN2YhmgUVXkZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634367570, "uuid": "010a8669-6f75-429a-94c0-721a98b7204c", "value": 861990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634367570, "uuid": "4bdf212e-4073-4394-9f7b-83ae19505f99", "value": "application/x-ms-wim", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367570, "uuid": "eb500c7f-40e5-4ce9-91bc-26d85c40c11a", "value": "Foreign_Bank Account Details.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c007cd0-2e4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634366899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366899, "uuid": "bad1420c-43b9-4107-a963-c175dcdc03b1", "comment": "Malware payload (Mirai)", "value": "f8625dd4bed2f33f76d49756fcff70f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366899, "uuid": "eecdd252-5b26-4c57-89a6-36cb051cdfbe", "comment": "Malware payload (Mirai)", "value": "0e402bdf3e081496c2af1df56e08bec15b7d287bb7932fc025ea345d60b30789", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366899, "uuid": "7f36e809-d0cd-47a7-99ca-9bb1e5d49b48", "comment": "Malware payload (Mirai)", "value": "c5bd14aba01ced9b4f647070235c9d37236c433f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366899, "uuid": "10315132-8f72-4632-9fb3-24b9662fa3ce", "comment": "Malware payload (Mirai)", "value": "1d5f3fb3d223195f378098af58278bcc9c4b3c5aa7caa13b1b3c6e4a974146110430268959c5a26059b9298ae6e53429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366899, "uuid": "5887481d-f564-490c-a3be-1111a864f09b", "value": "T110F2E0632949DDA5CFF0357AE6E16201BFA95F78D1A578B211602F14BBCFC8F606018B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366899, "uuid": "af05c3c5-fdd9-4e17-8c91-eee3f345eaad", "value": "768:Cb+GsIbn0XpiTAPB4bT9bOs26GIa+UqaXF1x9q3UELQO:Cb+GsLidbT4s26dVUqa0LH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634366899, "uuid": "302fb802-a165-4a77-892d-9763698096fa", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634366899, "uuid": "c1dcdcce-43d0-4cdf-9b82-aeaa717c0300", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366899, "uuid": "188a2014-aba1-466d-b709-78846153443e", "value": "f8625dd4bed2f33f76d49756fcff70f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192c62c0-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634393120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393120, "uuid": "5a43da24-1752-43ae-a5c7-b6150014ff2e", "comment": "Malware payload (RedLineStealer)", "value": "9160e2fa867538422a7d9f3d948e91c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393120, "uuid": "58024068-f540-4cb6-90c5-e3246e9339ff", "comment": "Malware payload (RedLineStealer)", "value": "0f072c9ed41be4f8a023d20af8e0a49f432a27e74e79cfb434270c0c87ea9e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393120, "uuid": "e4840fc0-5d6a-439b-bac0-fe6cd706f651", "comment": "Malware payload (RedLineStealer)", "value": "9751ad4f294ff8d7c067378f09288e7d142ee3ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393120, "uuid": "4c4a35e4-e9c9-4705-9e48-f386ec3ca478", "comment": "Malware payload (RedLineStealer)", "value": "f20b29c7322a9272dc986ea6f064ac8793e6b8a3fefbfb8434ae2d6102fbdab9b1d4f1e90be0dd8e8d2b64079d8b1ddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393120, "uuid": "fc078fc3-9521-4667-9311-c3c4b1a77269", "value": "T1E7E533B4CF68AE09F8B14C7E150DA87F90B4AC5D46EA7652B960256A03735F07831BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393120, "uuid": "09f9d8b7-374c-4548-a27d-8de440f1fe1f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393120, "uuid": "c3fd46db-51af-42ea-b8c4-2b16aed12534", "value": "98304:S6VcmEoZE1sW8KdpkcXORGlbPfNupmhdDRE:jV7X21ZsQtemfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393120, "uuid": "01399d76-98bd-4396-89b5-4d100fd0f41c", "value": 3230554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393120, "uuid": "9eb1cb80-46ca-4097-9b70-807aa2320d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393120, "uuid": "7d424428-3bc0-4ac9-8dd2-38ac12ab5829", "value": "ShinChangerFort.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfd4158-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350497, "uuid": "af7cd09c-73a7-453e-922d-4a283968d6f3", "comment": "Malware payload (Gafgyt)", "value": "eaf7372ff8dccc76e93aa01466bf2cda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350497, "uuid": "794a137b-928c-45b0-ad83-fed26e7c8b98", "comment": "Malware payload (Gafgyt)", "value": "105685dcf9fcc4b991e5a0165fb28d34a21bd536c768fa06a95d7e016db49149", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350497, "uuid": "febc0cb9-5e82-4bff-9771-1960a350ed22", "comment": "Malware payload (Gafgyt)", "value": "7deb67b7a59d34d2da8cd34d454e28e3af7d324a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350497, "uuid": "eadfc445-a2fa-4372-b8e7-00a0e2d74cb3", "comment": "Malware payload (Gafgyt)", "value": "0cb866ebe079f078eb4393f3d87bce936389aba665c2bd69200d08618a785a9f54faf97c21bd37b2c120922afeec8c50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350497, "uuid": "57155cd6-bdf1-473a-8e18-c47cdeda0c12", "value": "T17F933B47B71C0B93C89B59F12CBB3BF18769BAE1129761C46509EFD44372EB02412FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350497, "uuid": "a723277f-63e0-408e-8660-17b42f35477d", "value": "1536:pvHqkjJgiMOimdzl24K/yc9F3rzfRaXtlAyRdcHEmWFVqDrstWf29s:pvjvw4nc9F3PoMtHEmWFVqDrIWf29s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350497, "uuid": "e60b7425-e23c-4a2e-8ea3-c477e2b3f67a", "value": 97221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350497, "uuid": "88ca00e6-e099-406a-8bf0-a883a1d8dae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350497, "uuid": "dc033c8f-2fb2-4316-b8d7-4893ccf92f4d", "value": "eaf7372ff8dccc76e93aa01466bf2cda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fa0019-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634350465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350465, "uuid": "c254ad09-95a4-4b53-9d88-f0ad19db4cdb", "comment": "Malware payload (Mirai)", "value": "dbbd37a02861fa7ea1192785bf7d7b36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350465, "uuid": "c0893369-0ec4-4aab-b4ca-11b472098a1f", "comment": "Malware payload (Mirai)", "value": "1274725d2b127a18a8fa3e117214f4e256d7512665b18fa34d0f19a806a5f6d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350465, "uuid": "ed6d0400-c0e7-4aec-8b4a-e34ba41f3e37", "comment": "Malware payload (Mirai)", "value": "e635bb4f704235aa652c3592636b20ed11dd9fa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350465, "uuid": "eed57461-9b47-4ab7-a59e-07cc96ce3011", "comment": "Malware payload (Mirai)", "value": "eaa4b182cded12fa46b218e0c5a8897f2c65cfd1a7d47babe31c77a1be1dbc1a04bda7e6dab31ac23b09d5b3c447ee11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350465, "uuid": "02f8804c-5575-4c34-a21a-3ce989c70e39", "value": "T1D6330855B8848F46C5D421BBFF2E429E33265B9CD1EF7203AD125F55338B82B0E276A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350465, "uuid": "8e385fbc-8757-4d38-b749-534626d423bf", "value": "768:eddQYDQ4QFUY8rZJZGCg9f5vxLwOoUQNSWUF2DzdvaK8hqatXLRpr:QdQkQBx8rbZYHLZ7GUFQdvP8tXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350465, "uuid": "b51b2c40-6818-4976-ae5f-8cbb0bfb00a3", "value": 50320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350465, "uuid": "6d05ef2a-b53b-4b3f-9a0d-4f39d2c70a84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350465, "uuid": "e9279704-a771-4188-97dc-323f2f54e07b", "value": "dbbd37a02861fa7ea1192785bf7d7b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587eab4d-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634394515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394515, "uuid": "01f985d0-ccdd-4ed9-8bda-b3c9231304ae", "comment": "Malware payload (RedLineStealer)", "value": "5ac3d7e4f19ebbd92b1d50bd66533030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394515, "uuid": "3bd1c481-ba7a-4143-b652-03cdabdc44dd", "comment": "Malware payload (RedLineStealer)", "value": "1306e24bda80da1dacddc7c7d808502407cc8b29960d807aed0327050ba32be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394515, "uuid": "65ec4e73-2f23-4c8e-a5fd-51ba49189498", "comment": "Malware payload (RedLineStealer)", "value": "f06a226fa61decf73d0055e9c48f6cda68feeb62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394515, "uuid": "6c9c84a1-d5f1-4abd-adaf-e59f12ab0b28", "comment": "Malware payload (RedLineStealer)", "value": "ebdcdc3f2f062efdd1f91cec0b0c93d36dff9f1459183f5c1a05839cc8f4940f55d7d87eb6a97b0b29b673f1100cffcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394515, "uuid": "46d505f5-f0a4-44c3-b4f5-916dfe3b9b1d", "value": "T139663391B59E2FEED116C33C6240D665F55DB17644024BFEF00F3C658B29AF68ACCA82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394515, "uuid": "c107ace6-d22d-4a09-b61a-b25ca3c23589", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394515, "uuid": "8a221bdf-ab00-4188-a572-e65b101caa13", "value": "196608:7mQ7LkV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftm:7J7Lt90jVvBXvoww77rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394515, "uuid": "e37040ed-5b8c-4798-a716-334cec961cc3", "value": 6620672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394515, "uuid": "891e2311-610a-447a-8383-5b13e2d22e23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394515, "uuid": "289d9d59-d457-4535-95cb-7b78a4cbd76e", "value": "5ac3d7e4f19ebbd92b1d50bd66533030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f6e135-2e9c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634400820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634400820, "uuid": "47a12104-15b1-4a93-bbcd-31982caa9209", "comment": "Malware payload (AgentTesla)", "value": "db936d1f66b45cb0667faa86e10e3d73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634400820, "uuid": "464b7662-868e-430a-b17d-9a4d3afd9870", "comment": "Malware payload (AgentTesla)", "value": "13997ca8537609439505135fd73fbc53cd410fc54f307b8050c84b0c85bcc920", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634400820, "uuid": "99b4eb9b-888a-4df7-89b4-089cae83dedd", "comment": "Malware payload (AgentTesla)", "value": "b618c0f1b5c453afb85905e0bb8c1c8351cc5c44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634400820, "uuid": "cf7560bc-3df1-43bc-befb-6491493aed54", "comment": "Malware payload (AgentTesla)", "value": "3edc2a52f7be48129c58bcd1726250f4d73e965585cd7e35572631eb721c4ae0ad5037b797420b8422cd0437b7c98e9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634400820, "uuid": "ba111e58-9a06-46b4-8911-cfd728421d76", "value": "T1A6351202FAC1D871D8A32D315A39AB106D3E79215F349A6FE7E459BCAA305906134FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634400820, "uuid": "b48da9ef-a062-44a4-983d-7c7e51a74697", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634400820, "uuid": "9d8d9ed0-112d-4526-af9d-62a8e025d324", "value": "24576:rAOcZQh9J9h7TDb2BYMwprds5a6TPY5I7nT1RMwazO:tJcYMc96c5IzTXM7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634400820, "uuid": "44a0f201-bb84-445c-bdc4-17bda5849c56", "value": 1096186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634400820, "uuid": "69b74eb6-d953-4bcd-bf05-a5ae539d1709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634400820, "uuid": "433642c2-9597-4d29-96ab-9b10f5e89cc8", "value": "db936d1f66b45cb0667faa86e10e3d73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168592bf-2e43-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634362621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362621, "uuid": "40833fea-5333-40a9-a015-a9a547455838", "comment": "Malware payload (BitRAT)", "value": "13f1f0ee5ff3ae5aed34998cea5045f9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362621, "uuid": "52e6c990-78ed-47cc-afa5-5671ca7e124b", "comment": "Malware payload (BitRAT)", "value": "15b549b62f1f1eda3871a0c3993df3422d312b5bb1f38621b5406bc106d9c76e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362621, "uuid": "7ea484a9-7254-481a-8596-413ce80fa31b", "comment": "Malware payload (BitRAT)", "value": "d9a193d772f0069c6332a8cb180d5bb6740b7467", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362621, "uuid": "ff19cd75-ef9e-477e-a246-0ecaf3df05c2", "comment": "Malware payload (BitRAT)", "value": "dd29711386318d058220c66965ff0149f16e0b0e4aa9ee1d49fce418be309de73c06a0216c14848826852277077abd39", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634362621, "uuid": "d9c1d58b-df47-41dd-ad99-4924df098131", "value": "T15E630290A9A75E11D374F47DC17A36AAE1EB79087261E807CE1B7194CB99B03F04F690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634362621, "uuid": "20517713-69ec-4215-a1f5-b147b3bbcd65", "value": "1536:lYKt97gXLnhGxLnh0lHPDS6ONi76jcU9g8Zoj:VjY+gS6f6RJZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634362621, "uuid": "770f4210-323f-4ac1-8e30-d44f5465ca44", "value": 68900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634362621, "uuid": "30b5da19-c91c-48d3-b103-ae69d115691e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634362621, "uuid": "e639cce9-aaad-4945-a09b-f6ebc17885da", "value": "PO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e21d646-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634394578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394578, "uuid": "f0932547-2f64-4661-a809-38421dea3eba", "comment": "Malware payload (DanaBot)", "value": "478dcafd00ed193c9a89a248ec1665e4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394578, "uuid": "2e1ad570-e089-4513-9b9b-adf82d386b96", "comment": "Malware payload (DanaBot)", "value": "165f281fe26eb8a14657d69da2b56254c7c517800e57f3d26d83d6db8f33ae62", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394578, "uuid": "d991d7d6-1492-4756-acf9-10d6f2a1465d", "comment": "Malware payload (DanaBot)", "value": "c503d599b9bcc7d0adde4d0ab635e1e475d33a13", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394578, "uuid": "87b25561-839e-4f39-b8cd-80ff078c1d28", "comment": "Malware payload (DanaBot)", "value": "af078fd212abe8f1b8d0d5de6136caeed3f24cd2d29b908896fea012397feb9af61f11b2086fb6f6e7cad2d955089612", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394578, "uuid": "34ce276b-3c81-4679-a086-b8620debbba0", "value": "T1A5451210B6A0C035F5B313F98AB99329AD3E7D619B28A4CF22C515EE57656E1EC7030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394578, "uuid": "7f4bb60b-4d0b-4f90-9eaa-391ae21c13f8", "value": "8d9ee1d37ce0771b137ef02c8f52b4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394578, "uuid": "45358d42-34af-4150-ae3b-85d4189548fe", "value": "12288:+dFuyXcGXlcERDJW68+HfxNs/OLnk/v3dRuCKInq7leXR+glRAxHUIw4CXVGdBW9:+dAg7XmERl8M24kntLqhUHHAx/pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394578, "uuid": "e1b1265a-6a98-49af-90ef-cfcfa7a688cd", "value": 1210880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394578, "uuid": "c6ff6146-66f6-44a4-97dd-010f366d5a1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394578, "uuid": "c4e13bf9-a716-4f12-8434-c89bb1f24b73", "value": "478dcafd00ed193c9a89a248ec1665e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3814bbc-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634392627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392627, "uuid": "9b686f19-176c-42e8-98c3-f7a5f36fe120", "comment": "Malware payload (AgentTesla)", "value": "dc702423dbcc3369738c34d55c127a4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392627, "uuid": "ead6aabd-072c-40ec-bed3-a104c0887f8f", "comment": "Malware payload (AgentTesla)", "value": "16d34b543b9d89e41ba48b2dc96c1ebb4abef1f6f16b6e673a5f66cbfc44f32d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392627, "uuid": "6eec9e3c-91fb-4789-94d2-a938988bbe87", "comment": "Malware payload (AgentTesla)", "value": "e9176132895555bc75b6d55f28cea1a211c49864", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392627, "uuid": "156f9424-2523-482e-99d4-fbc48e6ae77b", "comment": "Malware payload (AgentTesla)", "value": "930478df087a2ddfbe1c267ca6464cba314cead5f923fa0c6070d0608c78668802304fa7324fc971edc19604f59285ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392627, "uuid": "5ccd3577-cc15-48b9-9b78-e469378dddaa", "value": "T18115D615F3439C12E55B467356E451E3A1046CD6E898833CEBB7BAA318BA3C05B4CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392627, "uuid": "329fc60e-3acf-4379-9d06-a1d01d95ca6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392627, "uuid": "1e8c5bfd-e005-49b1-b760-c5d7e4aa500e", "value": "24576:ZI5nYv7XocqMhzO0uXycPA2VYJUEKlCW:mVYvsDAz2XrBYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392627, "uuid": "eed8b717-9832-448c-943c-39edb1a45c33", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392627, "uuid": "4a239504-a70b-4547-bad4-de77331c4f6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392627, "uuid": "60890064-2f3e-4b39-9f6a-735f069721fb", "value": "Overdue invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bdd06d-2e74-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383774, "uuid": "52410b79-d096-4c8e-b373-da1ae834774a", "comment": "Malware payload (Gafgyt)", "value": "fb634b9c050faf35bcbc95066c65b4d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383774, "uuid": "c8c4f3d6-4d02-4793-8cb5-5173899aff83", "comment": "Malware payload (Gafgyt)", "value": "180506dcce555a74f913252aa430a86263ae496334d2b4c486184a22bb037524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383774, "uuid": "ce4bfddf-910e-4a88-9681-dcf099087f46", "comment": "Malware payload (Gafgyt)", "value": "4f401594d8bebe8814c53ee75a13d5e1c90157a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383774, "uuid": "5884e64e-4e95-4d71-ae49-f6c769e0ce2c", "comment": "Malware payload (Gafgyt)", "value": "8b49525533b5e697c36bc9e989ca4fdcbd09247133c3849db73614b5563b3da818a2f937da13c63b2d907e2081dd74d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383774, "uuid": "33402401-87ba-4d73-8b57-710e6876fea7", "value": "T151831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383774, "uuid": "81ad8021-38d7-40ab-955c-9af6c177d0db", "value": "1536:BQOc40ozMPjej5qckA39ikRFa/nrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BirWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383774, "uuid": "54fa92d4-e50e-44ad-b7e5-32ad952901e5", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383774, "uuid": "c1eed6d7-10f9-4c92-9a22-a093a61b409e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383774, "uuid": "8f86ef9f-24e6-414c-ab6e-367393a7fb50", "value": "fb634b9c050faf35bcbc95066c65b4d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9390bde6-2e14-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634342645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634342645, "uuid": "85238b97-9295-42f4-9eed-320a425c6278", "comment": "Malware payload", "value": "db7c88845707ad3a1894978cc57e3526", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634342645, "uuid": "17d2d366-154c-4110-be59-162a3e8a31e9", "comment": "Malware payload", "value": "18cb1fedbd4a15361e1dbe5b140c6100b1cfb462b92a180f3bf3a34068c4694f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634342645, "uuid": "28dd0895-2a81-4a75-82fd-102486ff4ce1", "comment": "Malware payload", "value": "d7e20e7f483b11f84cc0e1bb367459674a68c6df", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634342645, "uuid": "0d7b896d-d834-462e-af65-51a0ecd6bbd1", "comment": "Malware payload", "value": "bc977daee54b4418d2c213b3df66722129e624fa03e7acd5fb921debe2874157b9f7d8e5ac3b98237b52ab2e6a7a7818", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634342645, "uuid": "f1365ef1-8639-4045-abfc-3de1a6348b54", "value": "T1F566A711B7E94629F5BA0F30A8F71F425B7AFDC21D91CA1F2654265D2CB2B94CC70B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634342645, "uuid": "89d4927d-b14e-4050-a1ef-cda1102dfdc4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634342645, "uuid": "8de7f6b6-8cb5-4aee-b4e0-9495a73bd2ba", "value": "49152:M8E6B/6oJ2V1k0/6FJrA1oG4IDt9MVXybyCgr4rDmylH4uy9:M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634342645, "uuid": "3954dfce-d745-4a43-ac74-7acb78681cf0", "value": 6731776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634342645, "uuid": "51c6c06a-5de9-4210-9c44-f2c56a140196", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634342645, "uuid": "c415ae7f-37d1-4dc2-a4e7-c70c798e3527", "value": "SecuriteInfo.com.Trojan.Inject.13593.9374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b78110e-2e6e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634381259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381259, "uuid": "e4a44918-027d-415d-bf54-7ffeec51a28d", "comment": "Malware payload (Mirai)", "value": "8665184baea1b613142c310996c11baf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381259, "uuid": "89fc9832-0a75-40a6-936a-b4eeb2409f94", "comment": "Malware payload (Mirai)", "value": "1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381259, "uuid": "1a05610d-2391-47e9-8ba7-9e69a2f9a221", "comment": "Malware payload (Mirai)", "value": "68737674d38970bcca4f02f6a59ab608ee2aae41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381259, "uuid": "18235bef-6054-4bb1-91b3-0cb44081681e", "comment": "Malware payload (Mirai)", "value": "c45145fd3de802a41d7dd6b7ff3660efc47ea3f5df264dbf97e44050e45acf8b94c8d23dc2c622a28c5a450a98b95c0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381259, "uuid": "71bbada4-035a-48e9-8c91-847063854cde", "value": "T1A0B39DDBB70B5691DC6286F40BC74BED3A2323119F67C8E7AD0E263959381DE4A06391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381259, "uuid": "3f34c0a2-e6ef-4a86-a393-2a2e350625f4", "value": "1536:5LtB/e0scGqqVrdwTND2CVSQwXq8HqaRgN/LWE:V/e0Cq0uBD2LXq8HqaRgNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381259, "uuid": "50b46951-991a-4d4b-b96e-e25954e84ee7", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381259, "uuid": "8dec78c9-8427-4591-a3ab-1fc99724bf4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381259, "uuid": "7c0ec2d0-ac39-4145-9da8-c840b23950dd", "value": "8665184baea1b613142c310996c11baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147aa83a-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634396119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396119, "uuid": "b84af25b-2d38-4342-b8bf-08c5862acea1", "comment": "Malware payload (Mirai)", "value": "a9458db11a11462ecf59cc1d955af926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396119, "uuid": "ea665008-e833-4781-867f-fa6a05b4fffd", "comment": "Malware payload (Mirai)", "value": "1ab5b4bdc843571975b45883784717cda0f92ca1113723ba81c8b6b278bea271", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396119, "uuid": "4e2cb4f3-60d7-47d4-8e03-0d5c4214e1e2", "comment": "Malware payload (Mirai)", "value": "7c985ac16c4875aa6b0c706641f35388304abb65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396119, "uuid": "d6d9eae5-e39a-4851-b7b0-5c9c7973842a", "comment": "Malware payload (Mirai)", "value": "7bdfaf0fd7f542bc41a30d9cf3c07f7fc0e0fa12eee6fbb7db7032dffe9018a9c82431d5f503f93482ca814e018af0db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396119, "uuid": "d6eafd1f-b234-433a-bac7-f6409e0baf2c", "value": "T19EC2D1718268A170E7F11C7BAFBE43909B6A291C748730A06790D32C95F35A395F8982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396119, "uuid": "dd3420ec-2170-496b-9bf5-9ec8d29d6024", "value": "768:SqYATUk3L8CfHR6T5k47AWH1r/k28vyfGV9c/JZc3U8:SKTUkQ5TCIeHvqh/JZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396119, "uuid": "ff8b4b3e-08cf-496d-b40d-a3ec6d9e96e9", "value": 27736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396119, "uuid": "ec0c6160-2a76-4a52-b499-70ddb8a0e173", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396119, "uuid": "e519bcc1-03be-442b-b8f3-394a42e5c721", "value": "a9458db11a11462ecf59cc1d955af926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235b4dec-2e3f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634360925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360925, "uuid": "6d08d8ed-c21b-4775-894b-70a5212eded0", "comment": "Malware payload", "value": "62794ed746b94423227574e8652f2eb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360925, "uuid": "109baf9d-3c96-4780-9d52-7141464c64bd", "comment": "Malware payload", "value": "1bcb06004cb45c1b9e0fcfcd67dd1a2b496da95c2490b15158a169db1f71c3de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360925, "uuid": "a16b9303-3b74-440d-8a70-f97397275490", "comment": "Malware payload", "value": "67df4dea752f60e5029a51d2cfef366f2bdff2ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360925, "uuid": "b5f47bb7-6757-4677-ad7d-37c476d8a39c", "comment": "Malware payload", "value": "142cbae314cc046abe12f043865051b4d71704c84830227d2a2a060e7521e68c1eb7334eb2f5db417a70010858a6df79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360925, "uuid": "2e372ec0-cfd1-409c-9e96-4e2598c7cda5", "value": "T149253A7A6CF9A677CAFE8F3E52733C1986606553708440062663FBC55891F36FB0B6A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360925, "uuid": "8bf28b3e-dbe3-46b9-b00d-72a8e0266204", "value": "12288:7I6YJuaKuWOqq4RIgYedO2NKz/TTIuqRN0shRuTx/uIdbQSpn4qMmn9:s6YoaKuWOqqqDN0sh6/ukp45K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634360925, "uuid": "854e56e1-5a5e-48dd-9d28-2703d6b25e69", "value": 970376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634360925, "uuid": "359357ed-1756-452c-ad51-be3949105609", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360925, "uuid": "119d9e30-2621-4a98-a188-b3d235baf2ad", "value": "066a8daa8f774085941d879fb08027b9.css", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62716aef-2e6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634379928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379928, "uuid": "725ad2fd-9842-441d-8760-373bda947b48", "comment": "Malware payload (Gafgyt)", "value": "5953890cb241663e67cb4369ef176157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379928, "uuid": "bfad67c9-9056-45a4-9b76-57fa3ef21d06", "comment": "Malware payload (Gafgyt)", "value": "1be742a482a27b7e6cb87e2ed65526e772d6e6c57df60461d462fe2d6b4f3961", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379928, "uuid": "2bbcbb4f-0a84-4797-984e-d1b613af2a87", "comment": "Malware payload (Gafgyt)", "value": "a847c970262a4fba6c65aa9b046a1f8bea41f9c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379928, "uuid": "9232f8a2-722d-43f6-a6e4-9ab72214928d", "comment": "Malware payload (Gafgyt)", "value": "a2b4cd47a2c0c274d204bf368fc19da56c8018d365501eca7a34a194dd19047bfac0610e858808bd6e6f1dfeef7b7942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379928, "uuid": "9f597c9e-72ca-4fc7-9e27-2d467c428055", "value": "T15F930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379928, "uuid": "674fce20-dff2-4ade-a7a5-e4d84eba2c6e", "value": "1536:LBkF9VQPAGZHYyEfgcqpq1innPTxHOxdePczYrmREqQ4b/X7XSee:OQFHYBv1WTMePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379928, "uuid": "3f920d59-9211-4a46-b293-3157fc9de4c7", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379928, "uuid": "5585305c-749a-4fe2-8d0b-9f9d92cb1e80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379928, "uuid": "19b113dd-9a4c-40b7-922e-267c0e9f170e", "value": "5953890cb241663e67cb4369ef176157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29988d4-2e4e-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634367688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367688, "uuid": "04dad8d9-f451-4b6a-b7cf-8651e48fd934", "comment": "Malware payload (DanaBot)", "value": "d61890ca02ba3ae5be16637c64f1f2b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367688, "uuid": "7b6695bb-041e-45fd-adc0-d934793d9735", "comment": "Malware payload (DanaBot)", "value": "1d853f68927005c2158b9e5730d78b0c13e7306339a2807cc24fdbf82e37b647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367688, "uuid": "08919b8a-e830-4f05-8327-c44d55175909", "comment": "Malware payload (DanaBot)", "value": "985e0b3bbbb0f4b22e7c1735806b58e4d6122d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367688, "uuid": "69b04315-4cbd-45de-945a-294490994a34", "comment": "Malware payload (DanaBot)", "value": "6dbde7d0ceb4807316858dc0388ab8fd2098331cce0502d0faf49632f14d3f24788d83a0371a51eb5499c26839e02d12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367688, "uuid": "b2de4feb-af1a-4e15-ad20-155539cbbcbb", "value": "T1DD66330A74869AFEF6F91D31D8C1D2580633FC53E2299F2E1A59FF1B6961632B413309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367688, "uuid": "34840e63-dd21-4871-8cfc-fa1fb8cafdea", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367688, "uuid": "b012b058-ea18-4458-a67d-52b5a19df44c", "value": "196608:4bCBPDwRPllk8VkPnwUgmQ3SBDmHRDk78P:4+BPDoPllk8VkfwZCDg478P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634367688, "uuid": "d6b071f5-7776-410e-8a49-39b6bf4d6d1b", "value": 6560282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634367688, "uuid": "738a507a-fbcf-4362-a6e2-4649b5e9e22f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367688, "uuid": "f036413a-1ca1-4d77-b157-cd5953c72c49", "value": "d61890ca02ba3ae5be16637c64f1f2b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5bd427-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634393667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393667, "uuid": "e4c0a566-4c5e-4de0-b483-9ce9c2721997", "comment": "Malware payload (AsyncRAT)", "value": "b2e2e6f8a0ffdc394132946d4cddbf60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393667, "uuid": "bfc2e2cb-f659-40e9-8854-0ace5202b57f", "comment": "Malware payload (AsyncRAT)", "value": "1d8f931e4e69330838c622831c8cb0225a5126f7141e77747b5cb07a23abf41b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393667, "uuid": "56927e0f-bc0b-41e9-9cc8-7167dba7566e", "comment": "Malware payload (AsyncRAT)", "value": "f68db033ed164f7520f058471eceb88618ae7421", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393667, "uuid": "c043e967-1fe0-4657-8a52-4d2b7cee1ef8", "comment": "Malware payload (AsyncRAT)", "value": "5f089e551d67a1305441066de2dfde7b33fa88034a412f2589d9b7b9a06eaba2800d681b50372b38f000e1496938ec9f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393667, "uuid": "e88eb64a-84d3-47b4-9410-ee4eebb81a39", "value": "T178231B103BE8852BF2BE4F78ACF26245867AF1673603D54E2CC441DB5613BC69642AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393667, "uuid": "0a5e16ec-ee26-4108-9d2c-7aa296ea599c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393667, "uuid": "d055fcad-16b8-4d66-bff5-6c527f57e3c7", "value": "768:DuyrN5T7w0vqWU8Cuzmo2qQ8Zb1cQPI82jbhgX3iz7+9Nwe0/HHjQqVEIKBDZDx:DuyrN5T7XL2MS86bOXSz7+9ae0fHcqV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393667, "uuid": "3ad42ef3-40aa-4da5-aeb1-e357ed94b2b2", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393667, "uuid": "eb7bf4a6-475b-426b-aeb9-816e2041c2c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393667, "uuid": "6c53da54-ca00-4668-8e39-25fe277e3889", "value": "b2e2e6f8a0ffdc394132946d4cddbf60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a6f3b3-2e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634369384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634369384, "uuid": "e211db04-4c44-4f0a-b42a-c5cdbb5f9f49", "comment": "Malware payload (Mirai)", "value": "25318c21ec98410d9cb6f8c42c2e2cf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634369384, "uuid": "ff769b4f-ee68-4ab0-8627-d4ac753e1dd1", "comment": "Malware payload (Mirai)", "value": "1da63a919741978d4fada73c200bb40ae25c6a18b0f4c08209d3ea03ddbb4f6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634369384, "uuid": "66a348e2-dcec-4a50-93ed-9844d019cae3", "comment": "Malware payload (Mirai)", "value": "f48256d70f411732bbce18fa74e8f29ec90af00d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634369384, "uuid": "4d271df5-9660-42e1-bc66-71e21e64b96f", "comment": "Malware payload (Mirai)", "value": "56b6a9a1b533589a3feb9b4e11569090efc6872be1a52647c4d5558cb134e116f1caaf4df3f348b7e674eeff83c609c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634369384, "uuid": "09936e82-2c61-4bca-86df-4d319af3e116", "value": "T1C633F111B2721F72ACB88877F5B541566AD887BC91C7F7B34208CA9C4562B8BF05E4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634369384, "uuid": "8073732e-a306-46f7-b4b2-8fb01006ca37", "value": "1536:kOIlMtSFSIhqUXKpdhi41Hf/ZV7Lv8WHz:kOmMoBlapbief/ZxLFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634369384, "uuid": "f73aedf6-3361-444f-b68c-676ec5fd5adf", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634369384, "uuid": "460d8b5e-c333-49a0-96d3-5e21e5640012", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634369384, "uuid": "ad0afae9-2cc1-462b-8d2d-9418d4d6e61c", "value": "25318c21ec98410d9cb6f8c42c2e2cf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6372eb0-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634394672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394672, "uuid": "6ef3c7e9-6345-4791-bc1d-aa9d04c3e9f6", "comment": "Malware payload (DanaBot)", "value": "49fb226d908936d2387ec05a4060eee8", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394672, "uuid": "b26a531f-0f4c-40b1-8db7-da22ff71d5ae", "comment": "Malware payload (DanaBot)", "value": "1df171fc5a2f6a2b2077b0d566f1e56425205329a956ba4c4e3a7bc600ce43e6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394672, "uuid": "aeaf3423-c793-4b3d-8805-8486f40c026e", "comment": "Malware payload (DanaBot)", "value": "2f10ec0cd547e900690b9fa91690409dba8defb9", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394672, "uuid": "537f7473-bcec-4fcb-88a2-a23496c8e4ac", "comment": "Malware payload (DanaBot)", "value": "88d8be2aca0908b126e929e82120eed79478ca94577de7a5a7d77cfc37350331f4ecada6b1fdfecd2e6296809aa9ad4b", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394672, "uuid": "77959a06-decf-4cf9-a5f5-f94f9a5a9a33", "value": "T16945120167D0C035E1F662F846B993B8A92D7AE19B3894CF72D613E95B356E1EC30723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394672, "uuid": "b8f3ec95-9400-4c0f-9b8b-f341c541cf5b", "value": "470518591ed4a5fa094199423463cb10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394672, "uuid": "27dafabe-7ce7-4638-805c-efdb384ba1fc", "value": "24576:L4Xa6+VfvvN+yKXcZYmXmr/ob+qNjOWC9iLOISuiBH6HEq:kfafvlj4crWsb+qN94W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394672, "uuid": "d5ce9ffd-e56f-40cf-b46c-27ed4b2baec9", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394672, "uuid": "4f788e98-80bd-4cc6-9047-77cd5e0df7eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394672, "uuid": "4f6d29b6-8ea5-48ae-a89a-a278e9e2e03c", "value": "49fb226d908936d2387ec05a4060eee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda641aa-2e83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634390416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634390416, "uuid": "641f85d2-fd48-4c44-ab6e-dd74d45fb132", "comment": "Malware payload (Formbook)", "value": "a514e1b9b6a313f06456520f1881c9a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634390416, "uuid": "b0a4ff9b-5e6e-467e-9c88-48524a24038d", "comment": "Malware payload (Formbook)", "value": "1e24e03e9ffdbe39ca8d357d0130aff5c50f2ddd7b2f613ab9dc01f02d0527d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634390416, "uuid": "62a806c4-51a5-47d5-a45b-fb027d8eddcf", "comment": "Malware payload (Formbook)", "value": "fa44250d46dc70d4a3061a6174d697245411fc05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634390416, "uuid": "c2c08cfa-ce32-4976-a940-98a9a6ccb608", "comment": "Malware payload (Formbook)", "value": "cd889aa07e51b4f6366367dcdc5d1c627a28bf89f0c3a1c5422945d4651b9b3d827293478b41a0398ce1746c53b3004f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634390416, "uuid": "19109065-0401-4925-9716-f21f9cb6a4e9", "value": "T1F4259F12F186807BD5621271CCDB43747D25AF117716AA0E2AEA3E1DDE753823D2BE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634390416, "uuid": "4f300dfe-cdc4-4eb4-b747-7101f070e0ad", "value": "7e0b35915997b61b69492f2ad70638c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634390416, "uuid": "c071390f-ec95-47a0-9cfc-9f116c257340", "value": "24576:NddzmAfhuBXTG8/jDMMh2sXe5q/E5X6TvA/h:NdlmGhuN5ec/E5XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634390416, "uuid": "b3bd157f-a944-4c08-a411-496c0b539de1", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634390416, "uuid": "9b6f78f3-c388-4121-8ff8-98340a6774b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634390416, "uuid": "5abcf3bf-4615-4a49-b2ec-1fab2de6b277", "value": "Purchasing Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e572fd3-2e8e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634394954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394954, "uuid": "304a5b29-9779-4e34-ac79-e537a318090d", "comment": "Malware payload", "value": "2ad10ddc599143cbc1c54a356edcd2f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394954, "uuid": "4ca52a6c-08f0-4852-a795-d51167b829ea", "comment": "Malware payload", "value": "1fbe5021b8f78bba25ae6627c22eb82de9d35ea86951c067a06d101d0cd8c879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394954, "uuid": "4ce7d0fd-c6ac-4a96-a384-61276867c056", "comment": "Malware payload", "value": "639e38355302c3d262867a7442fe6a2eea56e57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394954, "uuid": "6e5badb1-45e5-4099-a213-3a3594126ab4", "comment": "Malware payload", "value": "c84c7e29810532b80295f91723d038d1627f3e59ec07491b2f61e46be5a620b8e6fb69049576cc248d3d8f4511ba9d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394954, "uuid": "fc838637-10dc-4563-9b54-501bae6e38dc", "value": "T19832FB4263FD5318F2F36FB1AEB545A49B37BDE5BA35C66D0140006E08B0E68DE64B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394954, "uuid": "e992845f-58ec-4e19-9838-4e5e7c88527f", "value": "192:bzWLuwHMnu4xqjEZelVyTIG8Zs5RIRbZRujGE5A8Jo+JSPcDkUTX:bzmu1nu4xqYZtjgMRIRbZRujr5DJoMSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394954, "uuid": "30ce50fd-0c19-4005-8971-0bb25745e342", "value": 11907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394954, "uuid": "74e6af8d-02fb-44d6-a4c3-1236d719c9d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394954, "uuid": "4c2a006d-f22d-459d-aa25-440bc1897759", "value": "2ad10ddc599143cbc1c54a356edcd2f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba87748-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380669, "uuid": "6383bc37-5a82-4022-b830-9a6acade6bed", "comment": "Malware payload (Gafgyt)", "value": "f488681ca7b8b8587e378b12ca6df5c6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380669, "uuid": "f16c8f7c-e1f7-4384-ba1f-110b2190a362", "comment": "Malware payload (Gafgyt)", "value": "20659aafbba3e4a455158986bbc6f1167b6494250df7e5b8284dc4d9ca730719", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380669, "uuid": "5c4948da-5e65-407f-82f8-da75bb772fdb", "comment": "Malware payload (Gafgyt)", "value": "7cdd9613efb9b8cca6abd30910cefa62af335eb9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380669, "uuid": "02b68d37-a097-4dcc-b875-8336edaa76b6", "comment": "Malware payload (Gafgyt)", "value": "fb37346125a29e2d6b77d5a762aa3fe9e91bf98692bdaf5869ae466c950e6337141feb8c3e361a409a631d3ddb5ee248", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380669, "uuid": "a488fb3d-d4f9-4134-9a5f-307ff9c90a9e", "value": "T196935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380669, "uuid": "5a3bca5e-a04a-42d8-8bdd-69446776e515", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3qyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKaifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380669, "uuid": "257e040b-1a46-4e65-aca7-21002949fb50", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380669, "uuid": "cf1f7645-c4ac-4a4f-b46a-362cb97b2919", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380669, "uuid": "55e3e839-7af0-4306-a026-2e4e60e95877", "value": "f488681ca7b8b8587e378b12ca6df5c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6940456-2e89-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634392928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392928, "uuid": "59735afa-f1ba-415e-ac33-675970de6319", "comment": "Malware payload", "value": "63a67d91e115bbeee3612e76ae728da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392928, "uuid": "616e6ccb-c9e5-474b-a70d-4d19f7982694", "comment": "Malware payload", "value": "20b13931b5f5b131c4765ebac4b4a678c9838b8d117698636a2349ba06f165c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392928, "uuid": "b6ade62a-a317-4e52-9eec-d9d18582b86f", "comment": "Malware payload", "value": "0b4726a697a36bab197a6750701c4798204ff72d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392928, "uuid": "1945218f-0726-458a-b95f-2a6985cbb856", "comment": "Malware payload", "value": "844b703928ab1cb43c7b630da4bc0176f442e6b464d704f44374756334c4f52f477d4bde86a248ba42c1d4a87c778720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392928, "uuid": "3b942a82-1bd9-43c0-980c-3c9549f43aee", "value": "T11573AE5227AC9B32D47CE7BD8432440027F2E622D722EF9D7ECA44E8595BF058B9075A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392928, "uuid": "c457ed5c-4333-446c-a9e3-bcd7992b8daf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392928, "uuid": "63d03085-f0c7-4786-bdf6-9930abefd0aa", "value": "1536:Zu1CCipQX+VJ+RkIPe4c0q0Ky1ZfpgCawdZJMMiiHEuK0/v5pLlb9jwBT1KRk3r1:ZuO09KaJawdoLuKU5ND+qir1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392928, "uuid": "4f368092-7cbe-45de-af6c-af65e0045f97", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392928, "uuid": "1c30028a-8219-4eb9-a981-501d8d261175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392928, "uuid": "d14f5ffc-67d3-41d0-9b8b-dbf3eeedd351", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311c738c-2e77-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634385000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385000, "uuid": "f0c96071-23c0-41e8-abb6-1237b264802c", "comment": "Malware payload", "value": "3b6d7dd6bfabdbe81d72758ee76a33a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385000, "uuid": "30036f89-28eb-42c3-9c6a-2547e15e85ef", "comment": "Malware payload", "value": "211e66b03a9772e130be6d7dea6d76ccc00b54f8dedd2e4ac0c3ffba7387d6a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385000, "uuid": "05d3b973-7b18-4c20-b7b5-e1e06844d725", "comment": "Malware payload", "value": "a4f98199d6d340684910c8adf0c7b72b4f4e34f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385000, "uuid": "0628ed30-ea74-4e86-a374-43c11cd07043", "comment": "Malware payload", "value": "f6c0e70b6abe4cfc3f902dbd65ccc382d50c1d296e782b4de7f2b5fb60c84c82c8899883a1d5946e308d118c0b0f1ede", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634385000, "uuid": "1e99ed7f-ade1-4d01-9c02-8344bd351bca", "value": "T14303E1A3E1E4CE58D4D166F49CE897C0B7B0C7A639014B7DE0BFAD0E28E591114C6EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634385000, "uuid": "b81e2f1b-13a6-4ad0-8585-1f0a9419ed12", "value": "768:8n4f3sJD2DfBgErPo1fkpkEoWtFG8WM8vC4uVcqgw02NWXhWVZ0jZ:8n40JDwfGEEmpkExtFG8WM8K4u+qgw0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634385000, "uuid": "a5f30572-7968-4997-b7ad-f9cc570fcaed", "value": 41260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634385000, "uuid": "05cf616a-c9ad-4fb4-8ae0-ed9e123b82d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634385000, "uuid": "697442b0-7272-4817-89dd-05753c33377f", "value": "3b6d7dd6bfabdbe81d72758ee76a33a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72415fbf-2e25-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634349890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349890, "uuid": "3af79f5a-d9b4-4a0d-b7e8-08969a605b74", "comment": "Malware payload (Mirai)", "value": "351f756b66ccea4a130fb3a1b90cd518", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349890, "uuid": "35ec8da8-917a-43aa-97dc-424f58f85ea3", "comment": "Malware payload (Mirai)", "value": "243bc57c18b4a2232204e66ce8e860356b2684c4d592491c3b48a319cfa43b74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349890, "uuid": "e8acec3a-7cbb-402e-87e1-a752fa80e23f", "comment": "Malware payload (Mirai)", "value": "858c926e1a2ed738a8d8aa8e045403e7b0259152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349890, "uuid": "03a87e5f-95c6-425f-ba3d-e06f9d515c63", "comment": "Malware payload (Mirai)", "value": "8f85ef81f5653511af8dc678c381887e786534a4596788b20da15117a8a8452d2cfd88d1427e0d121bc531656ec21848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349890, "uuid": "768034f3-9dcd-46cc-9baf-7ec7a72bc538", "value": "T1AF8340867FA13FBFD81ECC334194DA06129C891952A5BFB76B74E408B74724A5AD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349890, "uuid": "f9da7775-934c-40b0-867c-41b4e8c1ecf4", "value": "768:SoLn0DlQVniDlQvsb9UOCvD1HUJYGAjV5MvIsDsGIhBomex6NVn+RMCbbDrV4+TF:S2hUCLdMYzjV5MvIje6LmbDrKQBcElZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634349890, "uuid": "12a39596-3686-493d-9e0e-fa10756cfd05", "value": 86456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634349890, "uuid": "f32ce104-92ba-42a0-bc3a-f654c3395ac2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349890, "uuid": "6dea4333-422b-4d57-87ae-17c29d3397ab", "value": "351f756b66ccea4a130fb3a1b90cd518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93981c0f-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634394614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394614, "uuid": "e595c593-7efc-4b6f-8d42-cfe56872afc3", "comment": "Malware payload (Mirai)", "value": "a8937e6c9a4a1b691d1987c4eeb6aab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394614, "uuid": "d78ba0ed-4569-4a51-bc4d-0c94b0237cd9", "comment": "Malware payload (Mirai)", "value": "2480a7278bbd75a79766e6e718526f4c1375773fa551dbacf6f55a7ef43dc93c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394614, "uuid": "04a13f49-c8d8-4a20-8bd9-c216dc703f56", "comment": "Malware payload (Mirai)", "value": "b211b7f61b65b5b4fcd554a4e55528ebe13c23e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394614, "uuid": "03445618-ebca-49b8-8bd8-8e51e2d76de0", "comment": "Malware payload (Mirai)", "value": "7df8b58f88ebf666af8b78df02c2821b9a0cc2d39d4cc155ee440b8cfba9081859b9dd3f060855e6edb8a98996573ad5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394614, "uuid": "fb167288-815f-4a0d-98e6-34efc59c85c6", "value": "T140D2E12C131254BBFA1D04BA4A6C03D1F6AE7F4BE685DCCF2C02E5D20E535A9B5167E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394614, "uuid": "6adc3b45-ea82-4a89-b162-6930196bfaef", "value": "768:NdROPKCeWeQBDz9WLIMPFQkPm7psv3C79czJgGlzDpUYsr:bkPKfQBz9WHFE7ps679OVqY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394614, "uuid": "45ef9a5e-4755-4c52-a047-ce6e90105896", "value": 29832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394614, "uuid": "9e609d1c-07c6-46aa-b9ef-a510a754fdd6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394614, "uuid": "1d2a9972-aece-4f95-a9b3-c237448de26a", "value": "a8937e6c9a4a1b691d1987c4eeb6aab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba711ad-2e6f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634381903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381903, "uuid": "497dba92-029d-4106-bc2b-6135e29bc3b5", "comment": "Malware payload (RedLineStealer)", "value": "592bff278b2bf2551ca505447229c399", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381903, "uuid": "1aefcd3d-ad6c-42a6-8471-15a44e6f81f9", "comment": "Malware payload (RedLineStealer)", "value": "24842beeccc32b2247b404694796aa988f94487b26855b0e1b2dbad88d391b33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381903, "uuid": "591e0fc4-71ed-4980-bd83-4cff35e4c5b8", "comment": "Malware payload (RedLineStealer)", "value": "a732a1a749b3cde718dafb9944eec21535041614", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381903, "uuid": "e41fdfbb-0b7a-4e73-bdcd-6f19657e4491", "comment": "Malware payload (RedLineStealer)", "value": "1dc2539cce4564048bd5570a776fe9abf884898e899760df4aed73a01a4931faee17826e49bfc6cd4d147664b12404bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381903, "uuid": "531e3b0d-b901-4f43-b07a-167f72903873", "value": "T10873B577016194AAC5492730F4B51F0B7ABCD6341980B698F04FF2AAEC1D69D9EF83B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381903, "uuid": "0a624de3-2fef-4c2b-965e-253cc2df7cb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381903, "uuid": "2be1a067-fdea-478b-bb87-63faa9e707d6", "value": "1536:o3Cmd6dyEr0YJTFfjcx8JFheeZrM3M2e:o3t+rbJTGWveeZ4te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381903, "uuid": "216a1534-9ac2-4c3c-baac-b560136224ae", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381903, "uuid": "44cf0576-86e0-4187-9374-d64b89c1b6be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381903, "uuid": "9ce45956-08cd-464b-bd16-bb5e181a517f", "value": "592bff278b2bf2551ca505447229c399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea83193b-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350521, "uuid": "639a797f-7816-4db2-9f63-14838c20978f", "comment": "Malware payload (Gafgyt)", "value": "c48a4223f02a5d96044b4cbb782b09f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350521, "uuid": "2c118788-4c3c-474d-899c-1b413d6b1b37", "comment": "Malware payload (Gafgyt)", "value": "25be1108352fb89f28f29d6753b87fb8f786e1bcfca358806cc6dcdcc3486635", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350521, "uuid": "e369957e-aff9-4922-9468-2264f8516035", "comment": "Malware payload (Gafgyt)", "value": "7f2ba5fdd8d3de3b308ce9e7a92195897c66b75d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350521, "uuid": "6eabcd96-777c-4808-ac72-132122b2fec2", "comment": "Malware payload (Gafgyt)", "value": "4712eb47660245eb8c3d2e94f22074d50a17d85d641d97203d38f5c2ed8f53492871312a9d72680400fec2aa44f995cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350521, "uuid": "b12a5b51-31c6-43a8-9cc6-99f9aa0ef9bd", "value": "T16FC31905D4508767C2D3137AEB9E465D37332BA893DB33115A34AFB82BC2B9D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350521, "uuid": "975066fe-5242-47c9-bc89-0699ad940db9", "value": "3072:Y+fwax7Q50t/OLs/TrQAD8PsQD5+fbmNQOY5NXAcl:YUwax7Q50/rQADi/ybmNQOY5RAcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350521, "uuid": "3354c8a2-e558-4cf1-9a92-168dffb87695", "value": 124057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350521, "uuid": "19e64964-e8e5-45e5-a10a-1678a98b6ef5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350521, "uuid": "b5867936-cb1d-4228-86be-34a3777d0d2b", "value": "c48a4223f02a5d96044b4cbb782b09f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1744d31e-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634380661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380661, "uuid": "cc63cde2-97ab-4374-bfe1-ee7e43b17ec4", "comment": "Malware payload (Mirai)", "value": "44270a7091c3c750e0c4a2d4059cd615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380661, "uuid": "1bb07cd0-1161-45e8-aa26-76d091f91306", "comment": "Malware payload (Mirai)", "value": "2729da9ad8ee0f9eb58d2626aad1dd6db7f093a7e28fee119949154fe5bb37a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380661, "uuid": "94fe5cd8-d6e8-47af-9af6-a27b95c87b1b", "comment": "Malware payload (Mirai)", "value": "fe3c02f2cbffa41c846218f082e68fc9fa0d1d89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380661, "uuid": "e5fa0596-31b4-4326-ae49-8d4804a55f30", "comment": "Malware payload (Mirai)", "value": "4ef2e7c10cfdc6f25561fd3afb20f107bf1bff4ff941ab8f9bd0d86eb92ed6460ff9717c89b1536cea40bf30abb5ffd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380661, "uuid": "2f5d19d9-fa50-46ca-b86e-37624a8a5c3e", "value": "T1FB63940E3E219FACFF9C823547B79E20A24933A627A1D544D15DEA021E7034E741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380661, "uuid": "b3c78fd8-7f10-4a6e-8a57-a677ea39c99e", "value": "1536:9c164DTmhOhk2pCZs7Px7PWc7PBTocA0/3xm/vQpxBFytffo5:mVDT8OKHHuxm/vQPBFYHo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380661, "uuid": "d967116c-e301-469b-9936-ccdec7116c3f", "value": 71664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380661, "uuid": "d89c9b7b-5790-4e9a-883e-ced2e8258528", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380661, "uuid": "be38f986-158c-4287-b640-cf1b1c565212", "value": "44270a7091c3c750e0c4a2d4059cd615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abc7ceb-2e5a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634372480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372480, "uuid": "ede05d1c-623d-40a0-8bb4-fe14d6d2053e", "comment": "Malware payload (AgentTesla)", "value": "0eee871554d41113a7581448776f77e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372480, "uuid": "421b7e7e-4bd6-4868-ab3e-d9f4391b4d28", "comment": "Malware payload (AgentTesla)", "value": "27f40f6895f42d0a93a06dbcb4ed97ad4c4bb96889494d6749e0f07e0fd39f6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372480, "uuid": "3a502659-5e9a-4672-9dd5-72aa7e95b6dc", "comment": "Malware payload (AgentTesla)", "value": "1da2a651455c120b9aa1580af5ab17a5d0e6e81a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372480, "uuid": "89e3d09d-b836-4beb-a2f6-ba792fab5a24", "comment": "Malware payload (AgentTesla)", "value": "2b988cb86587967544ab82f3196e8a895001f9f481f20c749f01a071301a46d79f381f2114f26fbbd461607c870c5edf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372480, "uuid": "fc64f71c-c8db-4701-b78f-c374ab9c4b9b", "value": "T1C11523CA431A031CEAFF8B3D55A114516ABA2E5FBD10EF6D2AC4743A8F793012E445F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372480, "uuid": "6a14779f-00c8-4b44-8410-b81c29e07e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372480, "uuid": "c727cfbb-de99-4203-b09a-9f601377af38", "value": "24576:qgkBsiGxe4WPUinUuUS+ndSP/J8ffr7uOJV4b:gBQP7jS+dS2fzyOJV4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634372480, "uuid": "ce908f57-5995-461f-b636-30f164f65ecf", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634372480, "uuid": "6e317723-ba1a-447e-9acb-c28eee3b4d6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372480, "uuid": "fc8a7413-1df6-4594-8033-3cd3a6204b63", "value": "Status of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03118ba3-2e7f-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634388358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388358, "uuid": "b8e794ef-7a8a-4626-8f67-4cb847300627", "comment": "Malware payload (Smoke Loader)", "value": "249eeda3013a9570291a9281b5672daf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388358, "uuid": "d71bea11-b860-4599-8fd7-88db56a20906", "comment": "Malware payload (Smoke Loader)", "value": "2a1a54fb7350b322f244a891e27cf54f0cfb7e60c07b8497448a65e182eba4da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388358, "uuid": "86fe4e1c-ff02-4452-b71d-0c850e27aa25", "comment": "Malware payload (Smoke Loader)", "value": "49980eab15d8ed43ceff69d04dd413bc46bd840c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388358, "uuid": "a7f12f2b-3805-4620-8d96-9b2434bb5bdd", "comment": "Malware payload (Smoke Loader)", "value": "b09bf0f29c60beba7ba012e3f7d0859da3d53281081a86cc6b51bd44de3e888070ce9405a79b4787eb40ad48980e39ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388358, "uuid": "f444e569-b85c-44a1-bdb5-3c36aa1c21b9", "value": "T1AA547D00B6A0C039F9B666F845BA9379B93F7EA06B3550CF51D516EE9634AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388358, "uuid": "6ed6e60b-32bc-48da-af7b-57cadaaee88d", "value": "3053f2a72602e54beffbd9d286711499", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388358, "uuid": "bd73dfe3-6baa-4e3c-bc46-6cb94f5fb267", "value": "3072:xu03JLy2yyDziha4/1yMjJyNQF67ZddoBXIPaElD2HGQvDzpTRZm9Mgs3YJwSXNM:xyyDziozSJyNQgiBXIPaEiHG4lRCIzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634388358, "uuid": "15e26652-5b7b-4695-8a35-d9b35ea87796", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634388358, "uuid": "92d40c8e-9cc5-4598-8594-b703b2f6369a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388358, "uuid": "754a5966-7424-4405-9db2-2482109d9a6d", "value": "249eeda3013a9570291a9281b5672daf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b317804-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634393553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393553, "uuid": "77d7fba5-47b8-4da0-b387-f2d683b5d02e", "comment": "Malware payload (SnakeKeylogger)", "value": "c351111fe20ea7efd3619ac89322a477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393553, "uuid": "b35cfee6-1f09-49cd-87c6-b4f4cdd24cb1", "comment": "Malware payload (SnakeKeylogger)", "value": "2ac91449fd255e02594e29de0f1c66c70fb0ba1af3dd87846ffe3e21503ffb4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393553, "uuid": "f93a6f6b-e68b-4521-af91-ef9e48a52738", "comment": "Malware payload (SnakeKeylogger)", "value": "c5ada672e229ccab0c18b670adea396f8720a4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393553, "uuid": "33258394-fe46-47e2-86b2-9acb4756e13c", "comment": "Malware payload (SnakeKeylogger)", "value": "8312194d36ef47c847168a48d3d1f1c6ed463cb66208c27e9b678bc483c27e6c05d061d519b6e15755ed349a8c631d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393553, "uuid": "32d7ff6d-70ca-4e4f-ad16-904924eff008", "value": "T1FDF4BFA4AA14D8B9D2B09F7C5AEEC4D48F526E411B079CCF2644B73F23B72D4D84A18D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393553, "uuid": "62fedfab-e2c2-4fbe-a8b0-8bcb9a8d25bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393553, "uuid": "947238f0-f167-4588-98c5-e2e116a47249", "value": "768:xwmdfKrsR/QUhSsSRoSrKrsR/QUhSsSRxuEDd9FOGt+MvMzfpDRu6Ai+zj7QymhL:x0rm/QUhL0Qrm/QUhL0TDdKE6pDhZCwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393553, "uuid": "d843b968-f7cd-40e3-baf2-3f0f60721bda", "value": 786872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393553, "uuid": "c40a9900-17e8-4d8b-b6b7-5b873c4dbb08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393553, "uuid": "912b7428-3a87-43a4-83e9-192d594c88d1", "value": "c351111fe20ea7efd3619ac89322a477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9ddfbe-2e6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634379944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379944, "uuid": "e7b104cd-5ffe-4438-9c1d-283e7c7c5b31", "comment": "Malware payload (Mirai)", "value": "3503a668f0db50e4e19d5047aaf682b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379944, "uuid": "b75d5b74-4674-4ba2-b8d0-1e688d37f08b", "comment": "Malware payload (Mirai)", "value": "2bfc131b8bdef843b80886462706b758a483a160b7fff48eff09478d78c37d07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379944, "uuid": "40e12a25-2fea-4d0e-a54b-6b570b136f43", "comment": "Malware payload (Mirai)", "value": "d15eb0aa149ac99d5b14eb72d2d5116b7fcd8598", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379944, "uuid": "85172a72-fe6c-4768-a883-746c08ea6412", "comment": "Malware payload (Mirai)", "value": "b27046835e393720fa36116a1e38612762ad71d13b16651214ca0621a19764e992cf52b0f06ed4fe36a704b363bfee60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379944, "uuid": "1cf984e0-6598-4bfc-9c75-d102fbd5a8d4", "value": "T1A8C33C46EB418A13C4D52776BAEF414A3323E754D3DB330699185FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379944, "uuid": "4c1ffd03-5462-4e78-9d19-253d1eb37c0c", "value": "3072:kZl5nBTdu40/9yTScClJTF54K+GSTxVj4j:yl/Tdux1yTScClBF9+GSTxVUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379944, "uuid": "e2441763-5e4d-490b-8a6b-feaff08a9c98", "value": 127644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379944, "uuid": "a784c055-8188-45b6-ab87-9339f8f8d24c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379944, "uuid": "f343b555-a943-431c-b56d-cd8a3801456d", "value": "3503a668f0db50e4e19d5047aaf682b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4a7ce4-2eb8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634412887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412887, "uuid": "06fa00f1-0438-4b23-993a-a04b94480363", "comment": "Malware payload", "value": "df5da21fdc878f323ac00be9432764d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412887, "uuid": "d3b9d3c2-7827-4733-b31c-2ddd524cf798", "comment": "Malware payload", "value": "2ca08c7f0fe92d9ca63f492b7f8e4b54afba0248cf40dc202a67f381d094cf3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412887, "uuid": "661a97c0-b6b2-4629-b8ad-f0f04790a328", "comment": "Malware payload", "value": "72df4a6d1e74446a01b34cfad7f1c5a0f6a0ab56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412887, "uuid": "9ae04c4c-6aa0-4520-a2e3-7439404012c5", "comment": "Malware payload", "value": "7a3dc6d3e9ee08db4fcb88b015864f048efe9c5fe4decc6716291d56451d23f359a5765548dbffd8f1dfe65b2e28b84d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634412887, "uuid": "622a0ec8-49f6-4f2a-801d-6388a74f7201", "value": "T1FDA3394172D18875F4B31E322871D9A49E2EFD640F659EAF6398022F0F385D09A35EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634412887, "uuid": "a72f5528-a30a-42aa-a1a4-2eff863c2134", "value": "2b20eeb6148aabd0fc53f3237cfb9a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634412887, "uuid": "aafad3a8-2a5c-4d91-b88d-e22b66acdff0", "value": "1536:2+Td2NTQCqdNeTOG/Yyz17QmSYYIKgD3DDO7y8VNCYX/isWcgIcdnws8nBs0HWfN:2+YTqPatQy57QGYFq3Dy7yKCS6JnNwWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634412887, "uuid": "417b084f-aef2-4b0b-a836-9fe0cc11e2c4", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634412887, "uuid": "b2578ebf-5882-40df-a406-a553df9177f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634412887, "uuid": "c434a8ec-b632-4d5b-8ff4-f5105d1b2f36", "value": "df5da21fdc878f323ac00be9432764d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9b286b-2e4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634366628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366628, "uuid": "adf1efbf-6af8-424a-a582-9f6ee06ef472", "comment": "Malware payload (Mirai)", "value": "711c5582ebc93cf99ad3abf762c8c60e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366628, "uuid": "5f901332-cdf9-43e1-9f47-fa59c30e27b3", "comment": "Malware payload (Mirai)", "value": "2d2a04fe6333ef3a584098e5177b3cfce451903612104cc7dfe55eaa828df1fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366628, "uuid": "39db46bf-65a4-4999-a408-e6c597462f34", "comment": "Malware payload (Mirai)", "value": "418c976c24e68f1520ee6e0875ab0aaf03b6d73b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366628, "uuid": "23bf2f71-fbfb-4747-9900-25c350045200", "comment": "Malware payload (Mirai)", "value": "debfde6f867f30f96998a6df9f2e8ba75a4c498467daba91ea29cb8291fd557d70bc9ea0afe0543104a55ebd60c3d4a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366628, "uuid": "8ac85a32-b137-4202-978f-8323a20d771c", "value": "T110535CD9B4119E7CF9CBEABE88224F0EF821221150931B27BA67FD937D32194DC52D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366628, "uuid": "6bae9279-a362-4453-8c91-1ed5337ed786", "value": "1536:j0pZfwJ/mebn9ykMBH7l88g1pQntF5LR5kSF/zlzs178X:j591o8xpmXlR5Vzy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634366628, "uuid": "82b8b4ce-4b80-45d9-bb6b-9135aca63558", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634366628, "uuid": "554aa575-8dcb-4d07-b135-f79438e69b0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366628, "uuid": "1f774c28-9f54-43d2-b7b3-b617bdc697a1", "value": "711c5582ebc93cf99ad3abf762c8c60e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adef82ed-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634352997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352997, "uuid": "85f9c31a-1978-4c76-a221-ffffd0f15728", "comment": "Malware payload (RedLineStealer)", "value": "2eaf6e6f54469ce1faf49aedd5b2284b", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352997, "uuid": "f8b8a063-cb01-4214-bfee-bc8d28257b59", "comment": "Malware payload (RedLineStealer)", "value": "31e7e054709f5b627f50b6b26f95c6e0536c7d03361c16c9677c70fe327a7181", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352997, "uuid": "e181033f-4e8b-42a3-ac36-f9a17d972d7b", "comment": "Malware payload (RedLineStealer)", "value": "b587eab0b70f65497176a982c042332f1d79f2b0", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352997, "uuid": "3da8df92-3e3d-4aac-9cab-921576240be1", "comment": "Malware payload (RedLineStealer)", "value": "d7b7a13447e4b1a95a02249f3e98ba739ca84800bda51b30cb37a6ed5724d525f7258ed2de4c071e7b1af1573a738bd0", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352997, "uuid": "26c1b69c-742a-4aef-acd7-44edd472cb8c", "value": "T16B53B477416254A6C5891335E4B50F0B3A7CD6381980B29CF44FF2EAEC1D68E8EF87A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352997, "uuid": "11750376-36ad-4c9f-988f-e7bcbbb018e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352997, "uuid": "688ba7c4-7797-413f-8b4b-a5b6d9b2f65d", "value": "768:TwWxATw5unHqd7wRDhisb0/iVtCAtEeJHnRbvmO+ZzZPT9vOHJa++RKUQZc5WnbU:TSsSHqFwDbCAtPRb4DQQVHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352997, "uuid": "2a2ad891-26c5-410d-ba6a-2d349397415d", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352997, "uuid": "c446638d-099c-4a66-8092-a2add2da3917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352997, "uuid": "95533efd-b7e6-4c50-911e-a86867a03b1c", "value": "IOI6w12lUDfF4tNCGf_7pzse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4161c7c-2e6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634379636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379636, "uuid": "483acc5a-386d-4c67-b848-475bde5fc38a", "comment": "Malware payload (Gafgyt)", "value": "e5f96c2e743a794cee7040a64e0388f6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379636, "uuid": "50f38f31-8d61-48aa-870f-6df39faa0a21", "comment": "Malware payload (Gafgyt)", "value": "32297d2ce0fa60991287e442e856271c0c89f299bd5ff56b8d6f015a55e8490e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379636, "uuid": "58446da0-8ce8-48b3-93af-72164959de9c", "comment": "Malware payload (Gafgyt)", "value": "374b6f4592c44850deccb407c157899716342479", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379636, "uuid": "df36e605-d5a5-409e-a1d2-5edd00d57678", "comment": "Malware payload (Gafgyt)", "value": "d94a6b7f044f4f6e8de5e32c3022a092731cc937bc8da44455b6c1d08c34836b92107baf3f8931f9d43cbda075250640", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379636, "uuid": "faee4bd5-f536-4bfb-a5cb-bda82c8e9297", "value": "T134836B23A651C6BBC0C75AF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379636, "uuid": "b01eb63f-8e6b-4e27-bdf8-b219e483b516", "value": "1536:eB7cH1LhKlBqISVhuzdPQq0aJP9sWtjG7ew3nBuWgf6UmoIYuOVje+ZNne:eRMhKlcduzdPv0o+QK7eknBunVmrYuO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379636, "uuid": "82527357-b269-4bd7-a652-49ebecc87816", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379636, "uuid": "2685d49d-08c5-4885-92be-b9a1ccb9e400", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379636, "uuid": "ccb9c44c-2119-4598-9ed0-d7213346d65c", "value": "e5f96c2e743a794cee7040a64e0388f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1beff2f-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634394718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394718, "uuid": "cbac1761-8a4e-4d29-b268-657644394753", "comment": "Malware payload (ArkeiStealer)", "value": "deae95754f08661dc895299dd91b6443", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394718, "uuid": "1babb16b-79d5-400e-8205-4e600862d614", "comment": "Malware payload (ArkeiStealer)", "value": "3276f5cb5545e19704b1ef2897c17d721d6e156323f48f19275997d3cc62d005", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394718, "uuid": "3cafc70f-63ba-493e-8aa0-5d323cefb713", "comment": "Malware payload (ArkeiStealer)", "value": "a3f86e7ab8d33ce2ee15aac5f75e998407addbfb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394718, "uuid": "7bf7c2d6-0c1f-4209-b959-c319b9ebc51d", "comment": "Malware payload (ArkeiStealer)", "value": "f4e8ed3307116b9b2d01fc1003e5ab40fbf8cecf293738cbaa1209b270d967b8e24b1b034d4495f78e3e589859afb3e2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394718, "uuid": "710ad3a0-c62f-4ed7-b74a-ca288c459033", "value": "T1C7F4F110A7A0C034F1B662F88A7993A9F93F7AA16B2499CF12D517FA47346D0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394718, "uuid": "35ec5f4b-d071-4f8a-a6d1-22fbf44b3ea7", "value": "470518591ed4a5fa094199423463cb10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394718, "uuid": "7205339d-0e56-48b6-9905-63608ac99021", "value": "12288:YYK2EUGqBZJLHjBVMUiJq/lEiLsnUKsSjFH8VakFPkiiTVhj5qnGd84eTQ:hGzqZBmUikNEvntbhH0OxeXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394718, "uuid": "d22f4ea5-9a88-4452-9f0b-d4b2bb025caa", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394718, "uuid": "b797925b-1527-4b1f-ad59-0b20131c7209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394718, "uuid": "4a8267ee-e47e-477c-8de9-93314467e396", "value": "deae95754f08661dc895299dd91b6443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe328e8-2e4c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634366744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366744, "uuid": "5c493f3c-9135-48a2-bd6e-3d0407bc268f", "comment": "Malware payload", "value": "492fbac9b1eea1196f2ab3c6242d6163", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366744, "uuid": "0e706a70-00d7-4b36-9d82-507de84d7a7c", "comment": "Malware payload", "value": "33ab72650d0f31edf36fbde7bd27ef797c1b93d60b6d5f084d1c0c2897e021fd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366744, "uuid": "08fbb72a-4a20-42a7-95b7-a64ce7fd1cea", "comment": "Malware payload", "value": "653828d0d1e66a5a6dd473d81e2ec2a887b69516", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366744, "uuid": "a180be2a-380f-48e0-976c-de9063ee4d44", "comment": "Malware payload", "value": "3731a2bef2e6f2314132f316d8f3ce0ca67db8bb37dd04519fd867f83a56db9a63d9c36ed1494766ce268bdeb3c1524f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366744, "uuid": "d23a5cbb-e19a-49b9-9181-8bbeb05f04b2", "value": "T1585533C54940D96AFB183DF26DDEC7F82128BD6225533E442CA182B54CB6FE7908CD6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366744, "uuid": "46c5fabe-c96b-460d-ae79-2ffc36173483", "value": "24576:Zu6uSjIUSb8Sfct2tz8nTjJY2DruytSojsWmULi2N6aDk4Oa+hEWUV7NS:Zt/jyzct9jy2fuetjjmULiJaDkRhEWGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634366744, "uuid": "826e54ec-b6e1-4f3d-b480-f5481d675912", "value": 1361699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634366744, "uuid": "0ff14e6c-9f6b-48d8-9d7d-1d6377ea0e8c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366744, "uuid": "1eeb1158-020f-4c1f-9e20-b51c00538e52", "value": "WPS- 3668-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dbe0b9-2eac-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634408063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408063, "uuid": "5ff08a60-7eb9-4333-ab99-557e37e64e49", "comment": "Malware payload (Cerberus)", "value": "4ed6bfe741982803744054d497744180", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408063, "uuid": "40c7964f-bb1a-4809-9c76-ca9143af4802", "comment": "Malware payload (Cerberus)", "value": "33f9c3fdb345146fc95dbe2bf2ea18d0cf7c1a64620862019c88c99f0f7726ab", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408063, "uuid": "36197bac-e56c-48df-9ff6-0490a9dfd623", "comment": "Malware payload (Cerberus)", "value": "9e8feaac343f2e43b1eb0cd0437ca59869164ebf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408063, "uuid": "c76c8b69-8d4d-4c81-a498-aa031e967f52", "comment": "Malware payload (Cerberus)", "value": "179733534b126704ee6aa3633d539d8641bbf06036cc68b3e2077db631ca57aea0b8883bd151e8541b024d0f41647eae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408063, "uuid": "9af047ac-0ae7-46ac-93d2-2b8fce79035a", "value": "T137D53399CA90D469C031EEB44E6B0241D5380F145B6597DFB0A87AA0E2F6EF4DC2DD3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408063, "uuid": "a5bd0380-6795-4535-b19e-07fb3fef6dae", "value": "49152:7FBUm7rX3NYBfx4KwguZpKAsmB1sZ3yyO1lg6x6bv96AMShbuw6G5ruIMUmcGID7:xBUWrX3NM5mguZ5ZB1Ptlgz6A1bu9G1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634408063, "uuid": "5a59f5d7-e6be-4c05-bdfe-4e39573afa65", "value": 2904648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634408063, "uuid": "8c407898-7799-4a03-83ca-0e748522f40f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408063, "uuid": "5377c8b9-f570-4ca1-8ab5-e71c48b86aba", "value": "Androidupdate_2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20de9987-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393133, "uuid": "30af6c29-4a0e-4f97-ac58-7d895419a7bd", "comment": "Malware payload (Mirai)", "value": "f2ab3c41775f8ec30e91d4c03ee5fbfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393133, "uuid": "35e97ad2-9ef5-4546-ac51-eb94fe23700f", "comment": "Malware payload (Mirai)", "value": "345701fdb1b5ee20ceb02f932b95774af30dd9e05f9e60da421f3cbc2f2c2ea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393133, "uuid": "1e8faaff-14b1-4649-a9ed-71804b6860dc", "comment": "Malware payload (Mirai)", "value": "ecf3fad88ba8d830d71aadd7fb8534520b313f04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393133, "uuid": "5c72e43c-0b68-49d6-899d-e94e95a0042b", "comment": "Malware payload (Mirai)", "value": "1ebcec2f43e3b774a199a37e03a52cfaa10db0897a6a9b5704de824a558c19446c1e90587c04529c99b85aaba8fc362a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393133, "uuid": "759f76df-78a9-4df5-bc3f-a8f099f21870", "value": "T1B673854D7E319F6CFBAD863487B74E219649339536E1C584D29CEA011E7034E342FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393133, "uuid": "af6e64be-e4ad-46c0-bf62-bf5a8314dc99", "value": "1536:EcVhD3icpt17tGsx5w9H/zjFKl+C8T5G5hCFqRcOsV6M3tPwUq:pVN3RpfEF9xE5hCFqRcOsIM9oUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393133, "uuid": "1050d7f6-f79e-4527-ac63-653f66226786", "value": 76072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393133, "uuid": "2e0c1445-0a2a-4fe8-94ad-18df1b93fbf7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393133, "uuid": "ff1a08e6-0fc2-46b8-a5b8-d5b3ecfd5f50", "value": "f2ab3c41775f8ec30e91d4c03ee5fbfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d633d1-2eb3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634410829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410829, "uuid": "bdbcedbf-e0c4-42ec-890e-f6004c535b20", "comment": "Malware payload (TrickBot)", "value": "d179996a78081d81f2fb9553f2906a3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410829, "uuid": "26cbeaa3-cad7-4cd9-abfc-3f5d82c89077", "comment": "Malware payload (TrickBot)", "value": "358660fdcb9d2c22748818d1717fc435c2de99ba79b7cf631432b1c800fc7d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410829, "uuid": "b5b3d1c5-935c-4e0a-9084-d210972451d2", "comment": "Malware payload (TrickBot)", "value": "fa83a61b722231730b93bdca162f394cefeff119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410829, "uuid": "3188dacb-64b6-478d-afce-402f43e49849", "comment": "Malware payload (TrickBot)", "value": "b85208318824d2c46bac535b56036fb44cda448100d4c196877885ce95b55d7824e35e76da84fff4d44b3e1c0fa288eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410829, "uuid": "7505a6b2-d935-4f1d-80e3-67fa921b6d87", "value": "T16A15BF1A3AF0C476C1A355700FF27B6AB6F9ED605B778AC753804A4D6D31DC14A3A23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410829, "uuid": "0ff4865b-8a48-49c6-8a9f-68424c9b73d9", "value": "d3d730d77f19513c17bee56cad3fbfd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410829, "uuid": "b53b0595-f22a-44fe-b586-934ee990e702", "value": "12288:0cfkUmruxF02xWt5bSoV/XHx8B8a4TrTEChqNi9rky/:KI02x+LXHqB8aErPqCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634410829, "uuid": "caf1d242-64bb-4e36-8ab0-44f99da763d4", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634410829, "uuid": "978f9653-ec70-489e-85dc-4ce28d17459e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410829, "uuid": "3c4ed9ba-2c5b-4045-8d3a-549369cd8cf6", "value": "d179996a78081d81f2fb9553f2906a3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8629f584-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634376982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376982, "uuid": "7cf804c6-2942-4679-9ba2-4158b94b1ae5", "comment": "Malware payload (Mirai)", "value": "77df7d56c8aa729dda437de78e3f6a32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376982, "uuid": "99cb691b-27ce-4131-86b5-ee42833a29a7", "comment": "Malware payload (Mirai)", "value": "37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376982, "uuid": "80fcd33f-dc6d-448c-b666-bb28d07f89c9", "comment": "Malware payload (Mirai)", "value": "7cc1aec06a81d73e0f86af53ed5569e0b90d9679", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376982, "uuid": "b57819a3-2038-4ea3-bdac-05af0562b501", "comment": "Malware payload (Mirai)", "value": "1857069743ca0e05ff6af1ead1a1784baac48a2e3a1c386d4290809c4b4420485b4448d369dbfa9e680868c7dd2d45f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376982, "uuid": "ec6c33b0-698f-4059-84e2-991cc738fd38", "value": "T14FE32B06F8004627C2D12BB7B35B438D7B265FA997CB3341EA297DB02FE17591A399D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376982, "uuid": "5984e55a-9625-4bda-b76e-615c588ce87a", "value": "3072:J/R2c/5sY313A7sZzZ94mNK9r5wOetJ8add9QzhsEYn6O2G7hdPXL5CQSU5WvQdy:KSZ94mQ95wOetJ8addQpYnDhXL5CQSUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376982, "uuid": "6fdcffee-e1e7-4fa4-a02d-4fecb3324fc5", "value": 149767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376982, "uuid": "068361da-d97c-447a-8c31-760967c977da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376982, "uuid": "8ba671bf-3d0b-4257-b3c5-5bfa47269010", "value": "77df7d56c8aa729dda437de78e3f6a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a24dac0-2e60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634375136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375136, "uuid": "35db6b5b-e86a-4d21-9771-f7eae9a40ecf", "comment": "Malware payload", "value": "15b07a629d540b34f289788859648e0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375136, "uuid": "641b4e90-4519-4715-ab4b-76accaae8690", "comment": "Malware payload", "value": "374e554468a7b6bace67c2257f3531d72ec2442a415e2f2411b511da40d6b628", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375136, "uuid": "1596da1c-ca85-42c1-8ded-c000f097cf64", "comment": "Malware payload", "value": "a388eddbde1716dddd4f338d267702ce6ae04260", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375136, "uuid": "bfb0ed3f-9a9e-4731-92a3-472e5baae0be", "comment": "Malware payload", "value": "c231ab23dfa64c63dee710506cbc37f01e6536305e419dca3642a72566355041e6b94c7a614a403ae55f3ad4485b3bf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634375136, "uuid": "a2c27f04-5b78-457b-b02e-21d2c2f5df2e", "value": "T11D936B10B5E1C471F17319352976DAE15A2EF9204F259EEB379C026E0F340D0AA3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634375136, "uuid": "e67091b8-74ca-4b84-95b6-a5af4674d474", "value": "b4f437d48e25c7b06031cb97b5e20cd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634375136, "uuid": "07b3a1fd-918b-49d3-b5ac-e1b0b31405fe", "value": "1536:e7MGZViupm7ir2Ooe+JciT1GdeYH2JaGdVtcrYxam5+s8jcdihWfM39P:e7CYZoBPTcYYH2cG6r4J7oWU3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634375136, "uuid": "a1706351-ba78-4d63-90b2-1d11bce471a7", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634375136, "uuid": "e1929104-9c6e-44f7-bd7b-680570f0e610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634375136, "uuid": "caea530f-2967-40e7-9c12-7023ca905e24", "value": "15b07a629d540b34f289788859648e0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e20532-2e1a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634345071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634345071, "uuid": "79d3e9c0-c9f6-4798-a5b5-8dc8eb99b3dd", "comment": "Malware payload", "value": "a42ec9e34cfd5ba9188721c6fa8c3fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634345071, "uuid": "79dfa857-a435-4d83-9092-e9cbf9478a5f", "comment": "Malware payload", "value": "383ab4d71a5a7d4200aacd7fdf97add5788a538aa380bd1cd5a5639eaf03c39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634345071, "uuid": "52d0cab3-280c-463e-8c21-a9b3542cf857", "comment": "Malware payload", "value": "69944abf96245928ddc5a9b683ea82f9cae8325d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634345071, "uuid": "29a2eca1-884f-46f8-b532-5a15b73c1155", "comment": "Malware payload", "value": "5eb3a11e27cf54f4f078436a537af64503a600cc91d03120b4f2086b4c7f33507d274e3d05c0017ea6e435d787918d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634345071, "uuid": "15e72db5-1656-4184-9900-7dec2e8b4289", "value": "T1EE9533B21A0E0324E45D0AB56ED2191E3F7FDF2487B22416CEF91FE2F52582679C5382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634345071, "uuid": "fa5880ab-841b-482e-b326-7e4cfbd043ff", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634345071, "uuid": "8702f2c5-dad4-4b3f-bceb-ef9dc0fd6259", "value": "49152:9j/X65ntVrUKpZG9XNr74eLnmZ/S0vR6RU4G4D:V/XY3YKpI9d74eLmZ/S0vR6RUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634345071, "uuid": "1af04c6a-6857-443c-b576-dc9887f1f0b6", "value": 2043904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634345071, "uuid": "e32f7da9-4a88-48f0-b6a9-28fa4addd8f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634345071, "uuid": "c6766df3-8efd-418a-891f-a26b8e7c5c22", "value": "a42ec9e34cfd5ba9188721c6fa8c3fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e37f6f1-2e72-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383035, "uuid": "8bb40f80-9f6d-4999-9cbb-383314c118a0", "comment": "Malware payload (Gafgyt)", "value": "63a19ce41551cf2a4a0085376e054581", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383035, "uuid": "57cd5c19-507e-4564-8309-6e5eaea3b138", "comment": "Malware payload (Gafgyt)", "value": "39a0c6da93745d8ff076d49c6ac799ee1df3cbb00dd4d0345517775966465ba5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383035, "uuid": "5c85a550-b403-4602-b545-92f38110ed82", "comment": "Malware payload (Gafgyt)", "value": "33323f6edae80cac87dcb8858ad68cacb8f98b56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383035, "uuid": "19c6da07-3255-4f90-ab0f-129debffa65d", "comment": "Malware payload (Gafgyt)", "value": "6a926efd1a15180d2b0265b8e1becc018422711444d3fe1ff2e47e21b8defdfae6f04e084e031996437b246c04497353", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383035, "uuid": "45b72a82-1f92-44a4-ab73-5ad4ef0ca43d", "value": "T15113E121D1CD644EFA6A053B3BD3ED4CE1A0721C71BC9FE56A48B537C960BA80CD66C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383035, "uuid": "7abc02d9-e2f5-4d5a-83eb-d18a247850b9", "value": "768:vloHr1xDeWSSl3AwK8ZMjOQ4PnbcuyD7UWyqELEG6w9wA:SL/KWSkvbPnouy8NqRGvwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383035, "uuid": "019e9dcb-376c-4e46-8c0f-474daa38df1f", "value": 41700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383035, "uuid": "352e0a31-1717-4c8c-8009-47c9ce18262c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383035, "uuid": "d16b1bcc-80eb-43c3-8e18-cbd1f183da17", "value": "63a19ce41551cf2a4a0085376e054581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060ccfd1-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634396094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396094, "uuid": "675af82a-b21b-4170-a666-73bd375598db", "comment": "Malware payload (Mirai)", "value": "03b55f4091a4d6ce088e4f0868d930c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396094, "uuid": "32157ee5-ee90-4efc-9240-c289ce06e4ca", "comment": "Malware payload (Mirai)", "value": "39c5c5e71b28837b6157baa9dd82775b195d82e6269faeb02b68ceeda1031500", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396094, "uuid": "760d65eb-98a7-4484-baa6-046937d20315", "comment": "Malware payload (Mirai)", "value": "f9c3c2166b63875fd105b79c3439ce2418dcd705", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396094, "uuid": "4accd65b-d184-4f47-9fc2-ac0446af321f", "comment": "Malware payload (Mirai)", "value": "a46702b72028032121ce468d438ecc4368c45b90e47df13587e45389d6423daa3fb93b72c4c0b60e42df84ac47c5ee00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396094, "uuid": "16ae09a3-2adb-4e45-a6e3-827ccea7dd90", "value": "T18CC2F190B4A5AB76E756317405DF47B4201CED7063E23355D88D802ECA33EAC52A67FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396094, "uuid": "8ede141f-da16-44da-abc9-a5a92179d3ff", "value": "768:rPnloJzM+8ViY8JNltOShK2Zpb8Pl5o2k:bnlCzP8pAjOYpcl5o2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396094, "uuid": "27f12494-1733-406f-9924-5650b31fb7ae", "value": 27108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396094, "uuid": "1fca583e-240c-44e4-9784-bc82cbaba51f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396094, "uuid": "09d0c1e2-b371-4316-baeb-0d480dbe9199", "value": "03b55f4091a4d6ce088e4f0868d930c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6fb283-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380620, "uuid": "c41ec159-568b-4ab8-84fd-d39c7f4647a4", "comment": "Malware payload (Gafgyt)", "value": "85bb5cf732c4b1af891d16cb105af35a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380620, "uuid": "14d1861c-35f8-4636-a544-d7bb990ad75a", "comment": "Malware payload (Gafgyt)", "value": "39e8e6808efbadc4d3dc8097bc0d48f8c8f4778886a8f0ff73b09e770ca50e47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380620, "uuid": "83993e14-94c2-44be-86fa-7c78418024e3", "comment": "Malware payload (Gafgyt)", "value": "2dca05c4cb468f88bdbe373c3c84c0a810e74340", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380620, "uuid": "4689d7e4-3466-47f1-8a4f-f84f5ab97e04", "comment": "Malware payload (Gafgyt)", "value": "7e8c4b5cbdbe5ab2ece1c55f5468543fedeb42ed738da4603d388624bf4eccf9609a46ce0ea8038d4585817ea2afd845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380620, "uuid": "5c0ff883-4276-40fc-9697-d11f379425a8", "value": "T1E7E33B09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380620, "uuid": "c56a2629-ebf9-46d0-b1b3-ce097e9ce02c", "value": "3072:Bn7aKpF4LSV9OdAKox7cennFEM/9OD4bxCkEFvmpwfvRQfZn:l7aKpF4eVZKotcenneM/9uvmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380620, "uuid": "7acf5447-3029-4df1-971e-df7f9a7cb794", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380620, "uuid": "7d3f05b5-dc59-425e-ae04-204a62c139de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380620, "uuid": "c160f82a-a395-473f-ab7f-01464631919b", "value": "85bb5cf732c4b1af891d16cb105af35a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c28dc7-2e50-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634368465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634368465, "uuid": "c437659a-5b23-41c9-b103-84e4dcb4ca2a", "comment": "Malware payload", "value": "8bb45ce4e6bcd2121ac3e3c96e17a359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634368465, "uuid": "d964dd6c-a555-4483-bafb-224ddfb15bd2", "comment": "Malware payload", "value": "39e9730f6c6877ee45744054953683938481b0312f511495d0cd35710367a8a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634368465, "uuid": "41c8e021-081d-495f-aa2c-cff88da67e87", "comment": "Malware payload", "value": "f56c37d12d9cd144fd309f88d63e41b9e5287fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634368465, "uuid": "34f14fbd-504d-449d-9036-175f7cfa79ab", "comment": "Malware payload", "value": "b998da2123e9c1e4053d4acbaeeeac7ce205afbb4821d70d039bea5709c2d08c77fdf50261e9f878bd88ae426ccfdbc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634368465, "uuid": "9dc8be90-605e-4ddd-90d8-0e1760493ffa", "value": "T106063301B6C34438E055163DDC6150D86D663EB929E7152A7DFCEA0EABFB2C22C39F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634368465, "uuid": "e20af6ce-7591-4a4c-b84d-ce9fe9fd1759", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634368465, "uuid": "ee540562-8d84-47a2-9e1f-c8e325bd1799", "value": "98304:ZtmajruVkzvqEgTVv86l9JPXXll3Zp06wUr:b/QgqEgHV3U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634368465, "uuid": "87650f7d-703b-4696-844c-f92b883ad8b0", "value": 3972013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634368465, "uuid": "4bc74367-7f4a-474b-a85f-5e50c47ae804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634368465, "uuid": "1d7363e7-5aea-4562-ba40-b6918c66e4f5", "value": "Synapse-X-Cracked_460637337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499b3382-2e74-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383752, "uuid": "c182c97c-c167-4b8f-ae91-71c05372ce2a", "comment": "Malware payload (Gafgyt)", "value": "1e8d9b4796ad90be2433f802aeea12a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383752, "uuid": "995945df-beb9-4daf-9afc-da02274f81d6", "comment": "Malware payload (Gafgyt)", "value": "3ab8f672a017a60c18ff82082e255fbb24dcebd5452450c30e873a156c849df0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383752, "uuid": "8d36d43f-3af6-4a13-835a-2eb50eeb50c7", "comment": "Malware payload (Gafgyt)", "value": "f06d9283ce6473b29200ea6aa358d5ab8c59bc95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383752, "uuid": "89333cef-a60c-463f-9cd8-613c3fa57afe", "comment": "Malware payload (Gafgyt)", "value": "71e2c731a7372fd8dff91e1a80a91e93a7af077b6e1c632b3f595024786ff036593cb192b81c8c0763a1c76e4adccc85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383752, "uuid": "f34d92cb-7b00-4aa2-b58b-19673be190a7", "value": "T18AB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383752, "uuid": "daeae180-8ed4-4524-9206-c39859d3227e", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2O5N2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUre0NTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383752, "uuid": "a9516325-51a5-4fc9-bb48-8ba0f8847c3d", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383752, "uuid": "685a6d1c-49ef-45a3-9f0b-85554f369d8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383752, "uuid": "7a4fc46c-3afa-4eee-ac06-7eb843c2410c", "value": "1e8d9b4796ad90be2433f802aeea12a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33533355-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393164, "uuid": "ecd2a879-929b-45d3-982a-8f6a9f7c9598", "comment": "Malware payload (Mirai)", "value": "fc8d32ed18582f247933c3f369183623", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393164, "uuid": "c9b8a737-ab52-4d28-8340-3c0148922986", "comment": "Malware payload (Mirai)", "value": "3c14c3bdf88deb34ce089b7310ed0ec667747c54927a900dbc775303e190531a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393164, "uuid": "b50a4c52-acea-4603-8287-f48d4b619ec2", "comment": "Malware payload (Mirai)", "value": "206ba9bd711eb2d4bbfab99513d48177df0c7f5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393164, "uuid": "04cb16c8-1c2d-40b8-8dd3-f55cfc74ddcd", "comment": "Malware payload (Mirai)", "value": "a72f434a5564650b58b21c86f31cb1c9d90c35b1a86495149b7edd31d63082cba3ce5086c229f33a1cafce5a6cccd874", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393164, "uuid": "1cfc081b-3c7b-46e4-871b-31eebc0506b4", "value": "T148535B35AC7A2E17C0E4A17B52F38325B1F5674F29688B2E7C610F8DBF41A4062672F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393164, "uuid": "411bd4e8-2833-4e3a-a0bf-42ec9204faa5", "value": "768:77w0cG27oL6bVA7d6G0v/i3kWS+bc99ZaJaaO+3HCo7eNSGj:fw0cG27CiVu6rv61SpYaI3Fer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393164, "uuid": "d3e78f7e-06fd-4389-aa28-ee96bb7531f1", "value": 61268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393164, "uuid": "8193a82d-bf4c-405d-a006-ee52795f3979", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393164, "uuid": "7a5908d9-c89a-44b5-9ad0-a2277e0b86b5", "value": "fc8d32ed18582f247933c3f369183623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9230995-2edb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634428204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428204, "uuid": "e8a09d02-1751-4330-97c8-c810e01bae06", "comment": "Malware payload (Mirai)", "value": "2ceafc1c35e109aefcd33a6a36117de5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428204, "uuid": "38fee53d-c09d-42cb-a646-8037bb335204", "comment": "Malware payload (Mirai)", "value": "3c35df35e5e2b0db61df1d37365011807d7bd323d9cfe813c9f675da1e2470c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428204, "uuid": "e80f5384-386f-4d15-8e92-a1d881057b12", "comment": "Malware payload (Mirai)", "value": "0ec3ec4b98cee9cf7f60d5b94d36574694c2b09c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428204, "uuid": "2d4fa241-f15b-4700-ad1c-fb16d5271ef1", "comment": "Malware payload (Mirai)", "value": "2a8a69e04cbb4242a31b35bda3ff51f29bf19344073633521d6543563ed4fd6e5ce5a3823c4f005715ca0fb675a72211", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428204, "uuid": "73079b3e-4e27-41ad-8e5e-1d1f4f8c820f", "value": "T186D2E1A5C524DA20D277307E8ECE2E6F56549208A0A147DFFF8C6825786EE742A147D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428204, "uuid": "b4baec78-7bad-47f8-a02b-0a1354477031", "value": "768:VMlVIVBzBeqC7Gb4oZIg4p5ua+A+sQYWGJQ1nbcuyD7UGQRjy:gVKhZI8RBslWGgnouy8GyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634428204, "uuid": "853ec4eb-b7fa-4cd4-bb24-1f4d3e1692bf", "value": 30376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634428204, "uuid": "6b6e33e5-5893-434a-90a4-1ad95bc0faab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428204, "uuid": "57238ccc-35ef-4665-a309-aee1673a4604", "value": "dark.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e68619-2e6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634379963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379963, "uuid": "caa3a054-2fdb-462d-93ff-1f7a3652ab7d", "comment": "Malware payload (Mirai)", "value": "4b07d1043670603e927d93e95c644cc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379963, "uuid": "be2103c5-4f99-4d45-9e5b-49e9f0c37313", "comment": "Malware payload (Mirai)", "value": "3c4576e3ab07f3651ee4462aa13f568f9b2c0de749489ac681132037698565c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379963, "uuid": "bb2ce354-8b0f-41a1-acfb-9b0a6aeb5349", "comment": "Malware payload (Mirai)", "value": "2e56efca96811efbded45e0489c6531dd7115ee1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379963, "uuid": "8aa1f02f-7dff-4fa1-b793-c69e90f3e4ee", "comment": "Malware payload (Mirai)", "value": "b0056b639b998eb1608794e25640ebee9095c2e5b2a77954bf43544412591264b317b968df10ae81c468392a2fe83c04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379963, "uuid": "5c048258-c471-4629-ba95-b8ce2a72d4d0", "value": "T149238D76D42DAEC4C6580678BA284D7C1B63F504C2532DF7679AC2A5940BEBCF50A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379963, "uuid": "8750c03a-d01b-4ab3-a113-1bb98a09b3ff", "value": "768:EaS/NvCzSsYOYoOe1hyqNhAcWMt1epwhgwK0BTAC9oJqXRNC38:EaS/gzS5OYuhyqNhv1SiSxJuNC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379963, "uuid": "2d904107-79ce-4346-9333-e750f6e50513", "value": 48704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379963, "uuid": "aa48e4f9-67ac-4594-80f7-647f898706cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379963, "uuid": "0cb6d093-0098-4679-862a-616f2e60d07a", "value": "4b07d1043670603e927d93e95c644cc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b27b0d-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634350163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350163, "uuid": "0cd687f1-f2d2-4f55-a36f-2018f773e8af", "comment": "Malware payload (Mirai)", "value": "5a2d057cc137e308ecad4746d6d03e5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350163, "uuid": "6d965558-914b-4a09-a8b7-f0b8d443fd38", "comment": "Malware payload (Mirai)", "value": "3d5749340e044743b630a0375d4ad117ea3cdb2c68c878a34740576c6265916b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350163, "uuid": "65fd95b7-9e71-49fa-b55c-a3e290565cc3", "comment": "Malware payload (Mirai)", "value": "45e78b923b6b3c656bb4652ba919205b793d074b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350163, "uuid": "16045113-99ab-43d5-9cb9-e90137f4cd9d", "comment": "Malware payload (Mirai)", "value": "c95362c41f54a01c7ac5ec94ac3fe09d9a73f7afdfbf925f12e5399640cb8128cfddb1c501f31b3a70979c027c299d5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350163, "uuid": "e641a185-6dd4-4b31-9359-4a83ed58748a", "value": "T151833B322B791F23C0E5A53940F7973B73B69B951A21820BBA655FC87F09AE031533E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350163, "uuid": "70628ce9-7bf7-46aa-b7dc-ab90a1f50625", "value": "1536:YuJcZd4VA6McyYZ1Ppn2SlKtmjG1Ir7OkcQ5G:sj5YbsSbG1Ir7jfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350163, "uuid": "cf8473ee-3e7a-40f3-a201-8ceeebb82a0b", "value": 86065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350163, "uuid": "9e14e174-84e6-4d5a-9782-f567bc7adaa0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350163, "uuid": "0f2d9a9c-03ba-4d92-8e22-d2c768b37e73", "value": "5a2d057cc137e308ecad4746d6d03e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f27af2b-2e66-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634377695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377695, "uuid": "15b96211-9e99-4ce6-a94c-ef3db95a5b3d", "comment": "Malware payload", "value": "f33b99acec0a503a26bb5f6ee2eb3def", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377695, "uuid": "a0fce252-f931-42bf-8f2b-76990e478ab2", "comment": "Malware payload", "value": "3db2d54113e054d56f35c4b6002a3db6413a7fa9695fb26130f8f76095117935", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377695, "uuid": "9cd1154c-bfb2-47a3-acf8-2914ff57cf77", "comment": "Malware payload", "value": "a1fc5a5e5b814bafc020ee8c648d7705a4fea971", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377695, "uuid": "00a0f01a-e377-4899-b444-cd87e8cb5410", "comment": "Malware payload", "value": "f316b44c14feadf3f3569b66a9195ca4eb99115b679464e9b56cb4550392cd61eebddfe4cee57cea9ddd537eff77e551", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377695, "uuid": "42cfdde4-9c37-41e9-8140-04801265759e", "value": "T14F936B10B5E1C471F17319352976DAE15A2EF9204F259EEB379C026E0F740D0AA3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377695, "uuid": "ae6d2c2a-703f-40dd-88e7-944fb27b37e4", "value": "b4f437d48e25c7b06031cb97b5e20cd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377695, "uuid": "eefb455e-faf3-4a05-870d-f6006506a464", "value": "1536:47MGLViupm7ir2Ooe+JciT1GdeYH2JaGdVtcrYxam5+s8jcdyhWfM3IP:47AYZoBPTcYYH2cG6r4J7YWU3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634377695, "uuid": "6a295c47-356c-44d7-b808-ab4c26466e90", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634377695, "uuid": "91d9e7e3-d102-4ec1-adb1-944fa239a8cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377695, "uuid": "689dce13-8d4a-4493-ab22-2842b2ea138d", "value": "f33b99acec0a503a26bb5f6ee2eb3def", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecf1bfd-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634396109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396109, "uuid": "bb95a318-8bbb-4c83-987a-d2d6279bb270", "comment": "Malware payload (Mirai)", "value": "673b0f56787a4cce86711f6b9014ea64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396109, "uuid": "f494e372-aec1-4771-8696-6d790d0c53f4", "comment": "Malware payload (Mirai)", "value": "3ddb530463e1b1efc9d05777ce76fc6fea4b51572e2737a5498533e8d6cb8b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396109, "uuid": "9ced9b40-a476-42d3-b998-eb64950829e6", "comment": "Malware payload (Mirai)", "value": "0fa631ccaa3c102a33167c8ef996039b7abd4146", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396109, "uuid": "8395edfb-a361-47c0-89e1-8b7af88fcc1a", "comment": "Malware payload (Mirai)", "value": "da1c9df50f027dfd59802a792212b6d575acdb2bf41fe9adb72e26be3f59bf5d59e5332b81198be52c39f749f26c9850", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396109, "uuid": "795afbd5-cbfa-42fc-8313-30b3626927d1", "value": "T177B2D1200220B8F2C5D25E316EED4541633A2DE6E49BB55F263B1334E9D959B6CF8077", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396109, "uuid": "3d06eb85-fee6-463a-bfd2-f883707a0dcb", "value": "384:2qcCWu0ljABoC5D5lCSy9VIc2qRC70ZVUKCbZhRN/H+o0zmiR94121mdGU5EZ:vcCGjcoAy59uc2i1cKWrZ0zmiRms3U2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396109, "uuid": "5c7bc79b-e4b0-4187-ae0f-991806452582", "value": 23688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396109, "uuid": "9a9d082b-d486-41dc-b77a-cd2ead94a823", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396109, "uuid": "df56c343-de04-420e-a494-d3253ae8bdab", "value": "673b0f56787a4cce86711f6b9014ea64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96327821-2e72-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634383022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383022, "uuid": "9a36bd05-775e-4622-8470-432296286db0", "comment": "Malware payload", "value": "3cf21518b20d08038884ed5c7106196a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383022, "uuid": "21ed8db8-5cf7-462e-b7f1-ef301f63affe", "comment": "Malware payload", "value": "418695eda7a9a069590f0cfca13bfb8707983a8025152faa43cd11e896535a13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383022, "uuid": "14261a77-3aa1-4507-a7e0-4655c4a04180", "comment": "Malware payload", "value": "06aee38d902ad2a75df4ae80f6c09c9b6dbbaace", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383022, "uuid": "654157fa-72c1-4c12-b3fb-d0d8124afa15", "comment": "Malware payload", "value": "b3edef1bebdce2e6cd88d5b74fe052db7a33b4c60b2fa1aa582086aa4b3e2883cdd9400a1f7286d7c5973e9f94bafc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383022, "uuid": "68b349db-2448-4fbe-9698-30508d056ff3", "value": "T1FE23F1CE62A124DACF7D1FB66986A3F3C0525385313F964B83D48C0EDAF5A42670B4E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383022, "uuid": "baee8882-6f11-43a4-83ca-cd07eb92ed16", "value": "768:OzDUj5Y9QpBYzNeekSMFd8Lj/o89GRYdruT2OmFJ3YqUFBlNWRNIr/Xhm5:M39gBY5J1jRoWFFFhUjKoXhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383022, "uuid": "568ae0ec-7a1a-425f-b39e-33ca6680deab", "value": 45572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383022, "uuid": "a97a554d-a822-4bf6-9008-da3db95b34f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383022, "uuid": "80e5641e-9261-4d8d-8ea9-1b9dbd38239b", "value": "3cf21518b20d08038884ed5c7106196a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af1e962-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393177, "uuid": "45b377e1-48c6-4868-a0ae-bba266cdd786", "comment": "Malware payload (Mirai)", "value": "52acb9c2ef2ed8206cbb0423608160f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393177, "uuid": "f660e900-b588-4b66-810f-7e66f9463151", "comment": "Malware payload (Mirai)", "value": "41dd8e254d6e713e909d8cba342d119b89936c25c3df46cf2aadd0238da1bca3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393177, "uuid": "0eb1a82c-a3cc-45ef-bd48-dafbdc61bdcd", "comment": "Malware payload (Mirai)", "value": "0a21ef8a0a7a89fdb160226d4079cd67b6c19b9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393177, "uuid": "fc4f703a-e741-481b-af1c-eea64b3db7e3", "comment": "Malware payload (Mirai)", "value": "bc8d7b2352650ab27f6ec78a86f3d5055df8cf126a24a6164d160553be7b7e53121ac03250b11763016f46068e863690", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393177, "uuid": "ae06d141-0c10-43e4-bf0e-31ebf9ed22d2", "value": "T10F338E61C96CAD44D25C42B1B9288E785323EA05EAA62FF54A8BC351D407FDCF12E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393177, "uuid": "712a71ca-643f-4074-b17e-b4a8adb00f1b", "value": "768:cu/Zo4AqUq6CYXAA9ia8CKBqAa5zwESENCoDRDoVMOTRniCsvQ1:h/ntUJCYB9ia8762DEYQOVHniCsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393177, "uuid": "f9476082-fb1b-44d6-8b26-9e377cf400f6", "value": 51124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393177, "uuid": "07024f48-d36d-426e-a935-efd8133c3efb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393177, "uuid": "dbef45cb-8d6a-4547-a8f9-80ccff0adfe9", "value": "52acb9c2ef2ed8206cbb0423608160f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697e4a7e-2e8f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634395402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395402, "uuid": "8e5a450e-fc64-42f0-9a76-71aedd3a12bf", "comment": "Malware payload (Mirai)", "value": "451a7b9255ff3b3fb10690f066117ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395402, "uuid": "422485bd-a5e0-4d1a-98b5-da67d6efed03", "comment": "Malware payload (Mirai)", "value": "429a3ca0e58d846c7ca5f1369dc1555659f53d3d2c139dbe893854d40404c238", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395402, "uuid": "c9441d84-e847-4fe1-8e46-80c190694a5d", "comment": "Malware payload (Mirai)", "value": "00714b28d324e15ca521663f8bc42e1458dddeb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395402, "uuid": "458d6baf-0520-43cf-83c0-6bf4d2c9c3a4", "comment": "Malware payload (Mirai)", "value": "9829955d626b34bc2e47e3d2540cff78498643964e3ef7f3aeeaa101a1171735591b3702a63e476e7c54db9b3656e269", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395402, "uuid": "4d6002d0-8f72-43d5-93cd-45183b095c3a", "value": "T1E9D2E1CED6FE39E9CD8C4DF8A08D15158C4935C0F0AA2BED6754AA6CE26B607F90C034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395402, "uuid": "8a50fe60-857a-4b03-ad6e-4c5b98bb0914", "value": "768:dkWXYFo6z0kLOBiNaOiAmHfLuXDmYtS+KfNgtbeWMm:q32FNOZmoDY+Kfq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634395402, "uuid": "bae3a45c-5e35-41e1-9a37-a4ffc2a29c8e", "value": 30736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634395402, "uuid": "16bebcd4-ae02-4dca-bbde-1ea37201dc36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395402, "uuid": "a5060207-b89c-49dd-ba9e-dbc697e8bcb0", "value": "451a7b9255ff3b3fb10690f066117ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23994f31-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634393567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393567, "uuid": "6cfda8b4-6635-4c8b-b59b-f62b5b0b871c", "comment": "Malware payload (BitRAT)", "value": "a58e3ccff2a4a756f1b43394ede7da08", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393567, "uuid": "7c2a3564-ec8c-4a23-a7f6-9ab9ede1e559", "comment": "Malware payload (BitRAT)", "value": "429d27119c5a756ece80437a20e87477622cb6c1dec612c27d864bd47fe8ef04", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393567, "uuid": "57c2b223-f7c7-4a05-8386-0b574d7745e8", "comment": "Malware payload (BitRAT)", "value": "189dc7c29e3523c38a9656e328c8a36903734b6d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393567, "uuid": "eadd2570-f5d5-41e8-8353-8741a537e000", "comment": "Malware payload (BitRAT)", "value": "1f55c92dcfe74bc5696821966326710161f9c8703839b14041835ff92da7bc54b45078ed6674b95e2bad66e73f5fa342", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393567, "uuid": "5f69fe1d-ea13-459f-a0e3-35e371494470", "value": "T1B4D5334622AB7D73D04E52B60FB181FE568E2BB1A905CEDB5342DE14CB76E46C2B0353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393567, "uuid": "76e686ae-c92a-4640-b8e5-0991209465fa", "value": "fbc2ee00d690edba30359018bdb1112c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393567, "uuid": "bd1b7022-ea5c-40f1-bb89-11a9c17895b0", "value": "49152:B6VUMZJ5WYQQv40JxRcODJ2ceMxJ0V59UYm2gmDSCayQRhoiRi9JuRqE+w2uoYxC:BQUmJ5W04UncOD0PMxJ05M2ltayQXriP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393567, "uuid": "cdbfe8cf-5f72-4dce-bca4-47145beda726", "value": 3006464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393567, "uuid": "4410cb9e-578c-478a-a430-483793740693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393567, "uuid": "d0f7a496-55d1-45d1-b5e8-4f009fffc0fc", "value": "a58e3ccff2a4a756f1b43394ede7da08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b2724e-2e48-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634364740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634364740, "uuid": "eb522758-e9db-4ee4-8a6c-24648c94e22c", "comment": "Malware payload (AgentTesla)", "value": "4b054b63b249e15b82f174bf81462380", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634364740, "uuid": "49be0232-6f2d-415c-a11f-93d619c0c130", "comment": "Malware payload (AgentTesla)", "value": "42bf7b08f18ee61ea442626736de1b8f8e270183f776405590c82162bee114be", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634364740, "uuid": "e449ca9e-a435-4ce4-b2d1-a7814c554218", "comment": "Malware payload (AgentTesla)", "value": "085051b6e2a624febdf0e86171948cfb48b53e99", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634364740, "uuid": "d51d497d-44bb-4964-8273-da9a5f88d1c6", "comment": "Malware payload (AgentTesla)", "value": "e3c829e1da3991fbcb415dd0dfaf2d3d51a50842ce6d32b29aed7bc44b3e63f893e7a4360acee32055b19b0dd11254bf", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634364740, "uuid": "845eee49-e89c-4577-a6f5-1825b140e6dd", "value": "T10D05834AE3529D41D59A867350E450E3F70C1C96E4889779AFB3BBE3089E3850B4CBDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634364740, "uuid": "548dc3fd-c843-44a4-818a-68ab39819da9", "value": "12288:avf3JDIL6tSpW0jtsHEN2LqDE0Pmoxj9svVXkZFFbl:oIIkW0xrN2YhmgUVXkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634364740, "uuid": "75091c4f-8069-4aa4-b9ee-087bea02ab10", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634364740, "uuid": "96cde843-c1b3-44af-8784-87f79d064c2f", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634364740, "uuid": "fc0cfb9b-5521-463e-abe7-6fde1377f17f", "value": "August statement of account.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a49521-2e8e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634394963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394963, "uuid": "3390bd30-afb4-48ab-b60a-28d30097c0bc", "comment": "Malware payload (Formbook)", "value": "00deba486ca6b7a95c550cb6916d4dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394963, "uuid": "dd9e8c8e-63b0-44d1-ab6d-8f7a1c2f59f9", "comment": "Malware payload (Formbook)", "value": "4340e97182604cbe78767ba17c66b1d106d7e28855fc5ef3737142b41656cd9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394963, "uuid": "95f98c8d-96c9-47d2-9bf8-01650c9743d3", "comment": "Malware payload (Formbook)", "value": "639a95c172626509c87841763128d1ccb5c88af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394963, "uuid": "336be5c5-b1bd-429c-897a-d315a6bea19f", "comment": "Malware payload (Formbook)", "value": "f594916be98ec9f5928a49376988ede617570572f1be397efed511c0c83968e87c912009cdce14b8493011cf9c62caf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394963, "uuid": "82b5dbda-8f2a-425e-88f1-f10015bfc4ce", "value": "T1211523190395630CEDFD8F312469A112BB36FC2BB812CF6E1988329F5F7AB624954179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394963, "uuid": "9f3f8305-ad37-4141-b2c4-494046721f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394963, "uuid": "fd8e0e2c-d40d-403e-83af-95a347ecb77b", "value": "24576:CnukBhRsIXOz6urvBVlJZ/tf5MD3AXaJEsN0i8d:WBhRsMu6qVxtkwq6Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394963, "uuid": "39f96f30-48a3-4eec-a699-4e9c1093ff8f", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394963, "uuid": "b31b949f-f7ff-4c02-8814-dea259bcdba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394963, "uuid": "e4f6519c-9f1e-4a9d-9427-92ee1a0dab8f", "value": "00deba486ca6b7a95c550cb6916d4dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799b2601-2e86-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1634391564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634391564, "uuid": "b3a5e708-f372-439a-96a4-fca052a90349", "comment": "Malware payload (Lu0Bot)", "value": "3790f02072e049dcc5ac5e49eae2527e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634391564, "uuid": "c17117e0-16fa-421a-bb64-0503836d4471", "comment": "Malware payload (Lu0Bot)", "value": "45964a7afb9d41eb319161c26215c5bea0334b388ecfb1520b83bb2d6984ad5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634391564, "uuid": "bb504c35-eca8-4d38-9f81-9f79c2f3d017", "comment": "Malware payload (Lu0Bot)", "value": "340c4f2af6d62411c4811281617d5044ab834694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634391564, "uuid": "111be095-0d46-4093-b605-ac07edd24451", "comment": "Malware payload (Lu0Bot)", "value": "3824a1d5c7a6e8d5e5041c0f57d9c030ee13c6d6bbdc0346b6fc27be489a3117f8f578a86278b5fe845a1e9c84f81121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634391564, "uuid": "b730fd81-b46b-4e7a-bd6f-bebe3d405dcb", "value": "T11E41C5BBEB9448E2D78741BD0D16120DD3B8652B47F3A227495000DDA369B599C7628B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634391564, "uuid": "051003a7-f835-475c-9725-217fd8dd6c61", "value": "6219cadacd987861e8d4e111ba332c1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634391564, "uuid": "f6f4023b-d784-48bb-8dad-f7948cfd5414", "value": "48:6QY0c+NFfTf75UHHkYSoLT3SrYah/Y8FfTf889xRBS:bNFfTftUHEYLLKYQbFfTfx9xRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634391564, "uuid": "aaa73e0b-e0d7-48ed-ac59-c43c39246402", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634391564, "uuid": "a7327ba5-12b8-4cb0-a325-b5de49fb7ae7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634391564, "uuid": "3bd35f12-2792-44ea-939f-1683781f1de3", "value": "usfive_20211016-134140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d27923b-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393153, "uuid": "431666d2-ccf7-43e1-80f9-b545dc9a24d0", "comment": "Malware payload (Mirai)", "value": "326cf334791096a5def4f49a54da0032", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393153, "uuid": "af062aeb-2f4b-4519-a14b-c9dae36a93e7", "comment": "Malware payload (Mirai)", "value": "47df394114cc247008eec1e8b1b7bad9cd2a0036de208f02427d54aed9625ff6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393153, "uuid": "b8d09242-0c4d-462d-807a-d501400e04a9", "comment": "Malware payload (Mirai)", "value": "26e29bbb45ab1ea60f77b44f2234988f1306cb8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393153, "uuid": "0f1e83ea-6d0c-4946-a9ab-2b30c7366126", "comment": "Malware payload (Mirai)", "value": "27c3acdceee7d556504ab548484c2bf3cb1894af7fbbaa797192d8e248a14a40d340fbd2ba02fb79942261bbc621b6ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393153, "uuid": "70aa0549-896b-4fab-829e-0e9f2e67caa9", "value": "T14A434A02765C0E47E1561EF17A3F1BE083AEED8011E4F5896A4FFA8E8176E735149E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393153, "uuid": "f7814dec-b0b9-41f8-ab70-12b8d9c5919b", "value": "768:/Q+l/pOkiChWcezMC1RD/TyJOdZIxPHXT46eSlH7GlD2jc6yUIyiKx1A:9niCGHkn06e0m2YPUIhKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393153, "uuid": "ddfb655e-6de0-4c4e-b772-32ce3b9900f8", "value": 55244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393153, "uuid": "f66bc7e3-f1ed-4d6f-88b5-4a25dc4fd293", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393153, "uuid": "7e87ddd0-0122-4203-ac6c-5cf780a64692", "value": "326cf334791096a5def4f49a54da0032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1feae97-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634353057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353057, "uuid": "00ee2005-069b-4943-bdaf-301a59328621", "comment": "Malware payload (RedLineStealer)", "value": "2123a938e8c8110f18ce079baffeb384", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353057, "uuid": "ce987f19-29b8-4aa3-9ea7-9df7d2535436", "comment": "Malware payload (RedLineStealer)", "value": "486a4e75e6160a9dd36971ef4442063568d340c97b672c55f0c5856878cb7e7d", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353057, "uuid": "80f211c1-1dd2-428e-b337-e6bfd22463d1", "comment": "Malware payload (RedLineStealer)", "value": "ba2a315da50baaafa57745370879cb1338cc47fa", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353057, "uuid": "e5f76e2a-c43a-4ce6-b164-7d619dfdf30a", "comment": "Malware payload (RedLineStealer)", "value": "5f62b10191c547ae5775f7b3ab97a01b04a71990a38f7cfd5424e4fe5e24915da413ca23ef0cfb79915077b8e8bf78c6", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353057, "uuid": "410948c9-9e80-4d9a-bae8-e6caaf317272", "value": "T10B74F6993254F1DED567C876C9991CF4AA217C7AC70B8203A0633EADB93D987CF150B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353057, "uuid": "13186f09-866c-4547-917b-2975cf0baca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353057, "uuid": "142a9752-ec4f-4955-981d-aacf5dfd3b60", "value": "6144:OR0RkNzoau7d0LeZAdANErJFv1B43kj3pDbVFFEzF47pwK65hvDmS1mBJ5PZtpp5:OR0RkSauh04DYbnZDb7FEzF47pwK65hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634353057, "uuid": "b1ecadbd-0e24-4295-9b97-a8269dd29b7f", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634353057, "uuid": "2a5d35b0-855c-4cbd-b8b9-da51974ddd19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353057, "uuid": "0379347d-3cb6-4804-8bc2-b70c1a56c051", "value": "SHenalaeshole.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2dff2d-2edb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634428206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428206, "uuid": "d80e13d8-e421-4edd-aa68-c2ff21c51c1a", "comment": "Malware payload (Mirai)", "value": "97cf97ca3858e6e07ef000d0a53880d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428206, "uuid": "7cda1a49-9a04-4a46-9cd8-7ac3e8758def", "comment": "Malware payload (Mirai)", "value": "4a58ac079c0e2d5a3676cf2522d4ba0b1b5cab8027bddc5ab2dd9ec044accf0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428206, "uuid": "785146b5-9c9c-4dc2-b3e4-0ea59a82d2dc", "comment": "Malware payload (Mirai)", "value": "942eeefc24ed52f0906083ab48dee4d85206d7a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428206, "uuid": "0916bd61-4f3f-4164-b7b5-f3c81ed33327", "comment": "Malware payload (Mirai)", "value": "045be72a99dd23849e29d714206b4a93a602414ec5173c9d3b938fb6bbd84b7370f174f73783f7dfa4652fa6433dc75d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428206, "uuid": "343b7f26-191b-4b9d-8ec1-9493ff8b3e07", "value": "T123D2F1755296AC12C6309C37C67BAE4EF6858AF8E2DB9536616CC3489CC283F0C6DC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428206, "uuid": "3691dc75-6a23-4c75-ae96-b9c750cc80d8", "value": "768:7Ufm0f2zsX6rSRm47xz1v4Ba+Ip9V0uhjdQs3UozD:4m0ftlmyxz1V+IjV0QdFzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634428206, "uuid": "3e4f5df0-2eef-48a5-8d13-6c846c20794d", "value": 30568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634428206, "uuid": "d3dcf507-2f86-44d0-83b4-df2e8ab35644", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428206, "uuid": "dfd1b8c1-13f0-4c02-901c-da55428fc84d", "value": "dark.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f2ab99-2e8e-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634394809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394809, "uuid": "656f701d-df54-4593-9df7-d1eb423fc370", "comment": "Malware payload (TrickBot)", "value": "eec52d33ec7b607e95ff20b0e586acae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394809, "uuid": "9789d300-27ae-4a19-b677-d012f5850901", "comment": "Malware payload (TrickBot)", "value": "4e93dcc21ee091596b5ecfac0c5076e14fff78617223cb1e19a2686c7113fade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394809, "uuid": "f8c5faf6-f4f6-4315-a5f9-39731a738e28", "comment": "Malware payload (TrickBot)", "value": "2e37bd35342b1e90cdfa7fd22d779d09b983d5a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394809, "uuid": "9d398a94-bfc3-4c48-901c-3aa3e4b49943", "comment": "Malware payload (TrickBot)", "value": "497d7457278dac6477485d4c01ec8a8035d1eb41f55a2a21554c4e8605df5a19c66d32360128249f758f1cd56ae490ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394809, "uuid": "1728a7bf-52f1-4d51-8939-2bc5e0b230ee", "value": "T12E15C01A3AF1C076C5A291700FF67B6AB6F9ED605B378AC753804E4D6D31DC1463A23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394809, "uuid": "e2aa6f66-b299-4b92-9a05-29ba830db4e6", "value": "d3d730d77f19513c17bee56cad3fbfd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394809, "uuid": "4acbed0b-c342-4995-bf88-5dabae973fba", "value": "12288:DEMkCMMFkUED6ANs4ZD9V63Az2hPmy+khUzJUZ/:m+ED6+xZzkmiig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394809, "uuid": "f9c86818-fc00-4d2f-bf5b-036bc044de8d", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394809, "uuid": "ee6cb912-f804-4b9a-99c4-e90c5def56f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394809, "uuid": "791d3025-f757-413d-9258-817768099609", "value": "eec52d33ec7b607e95ff20b0e586acae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0d9dfb-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393873, "uuid": "25b2e1ad-3902-420e-8a5f-78be6889d8a2", "comment": "Malware payload (Mirai)", "value": "00d526a7a222aced80eced4ff8797de9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393873, "uuid": "f33cd65e-13b4-40e5-91da-717c0d1d7edd", "comment": "Malware payload (Mirai)", "value": "4f770b79554a3ca422d3b122fc76e5f2087f08b134520f0e0773d8f7ef36826c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393873, "uuid": "076e7927-75bd-4517-b4ca-0ebfcd6d0a6b", "comment": "Malware payload (Mirai)", "value": "db40f9fa8417982e41e50da974a6561e84d6d317", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393873, "uuid": "09af731a-bf9b-42a5-803d-87c8e21efef4", "comment": "Malware payload (Mirai)", "value": "b22ad54bd40a27fbb8787381385d9a60e7bcab351b16409c0174ba66aeb8b5a72673fe97ac48b117ee76efd7cf989a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393873, "uuid": "859db14d-04a6-49b8-aa1e-fddd1ed7bad9", "value": "T1CD334CC9D983ECF5D811097130779F319AB6E97E6065FA43D7D9A532EE02602E10739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393873, "uuid": "ffff43ea-3018-4bf0-ab1c-72d4487f2a7a", "value": "768:MaDRcoWmr4xAh7byZORWoJO1z5LKJZ6DKK0xFMaPjyuZSU1:ZDRb4xAh7uZOR1O5+6DexFMaPjyugU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393873, "uuid": "cdd50da1-7656-4b87-9ed5-fc66f0ac2352", "value": 51356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393873, "uuid": "208cf861-a037-444b-927b-4c2b94c788f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393873, "uuid": "d85c021d-d5de-4d35-b5f6-b780411de7cb", "value": "00d526a7a222aced80eced4ff8797de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07db8825-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634393520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393520, "uuid": "7e3d1b3f-2b8c-4ff9-bc68-4961c09104ac", "comment": "Malware payload (SnakeKeylogger)", "value": "ff5a0e236b67ae058f6649c2d968c988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393520, "uuid": "13ad1cc6-522b-43f5-9048-b3473d3d4d88", "comment": "Malware payload (SnakeKeylogger)", "value": "502b905bce618c7f4dbb77883d212958535d89e6343444eb9dbaaf4c9e1cdd89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393520, "uuid": "d43c6e36-6b65-4a94-986a-07ae066032ff", "comment": "Malware payload (SnakeKeylogger)", "value": "d04013dc8cd9fab3dd0c63877d7803a869a26204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393520, "uuid": "604a4ecc-b6ae-4d7a-9fe5-8d51a19f6c3c", "comment": "Malware payload (SnakeKeylogger)", "value": "783758029a2a1d11e9747c149942db5e86749e1cb531f4b8277297ce47124ecb2367bb3443b7e4f44b7385fcd6f0eb31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393520, "uuid": "fd6cafb7-d324-406b-82fa-ca767b84df26", "value": "T10894CF9C765075EFC867C97A9AA82C24EA20747B430FD243A45311EDEE4DA9BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393520, "uuid": "b167ae21-0ec0-4d91-a71c-5b55473f5edf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393520, "uuid": "4cc17658-081a-4c34-b4e1-8f9c2cd6efdb", "value": "12288:DpPoneGijQp8dXl4N6/WVuXsqf9FPBiB8IN+d5RNOa:lo3uYekuX1fjPBiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393520, "uuid": "e1caedf2-0999-4ba0-96cc-f649bee1fe37", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393520, "uuid": "210be559-2d6f-411b-8ebd-f6e6df1c0a84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393520, "uuid": "2bcfb3fc-7085-49fa-a7a8-4a8a97698bb4", "value": "ff5a0e236b67ae058f6649c2d968c988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5d3ada-2e6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634379950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379950, "uuid": "0571d0dc-6e2a-403d-8955-9b7f9bdc3837", "comment": "Malware payload (Gafgyt)", "value": "a51bf79a2693bc80beb56986b98ed1f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379950, "uuid": "5f3d59b3-8547-4e69-b0d1-d153064be678", "comment": "Malware payload (Gafgyt)", "value": "504c80df6cf453e00e1013e6b8738ff659a9a6d634f56e6db3a182b9eb69b5f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379950, "uuid": "47abc957-cf3f-4425-9933-5850e7c77ef5", "comment": "Malware payload (Gafgyt)", "value": "4bf76e781cb0cc90d972d7cd1b786cac4211a187", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379950, "uuid": "e2df3cd7-a904-4799-8d69-0fb95144dc18", "comment": "Malware payload (Gafgyt)", "value": "6691b19f71d75b5e6bb544ab1a1d064d1ea219f85da98f29c42b86243d17614d28be3a90ff4b5a17c4dd2c9c1dd88a7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379950, "uuid": "857deeba-2fe0-4ffb-9361-bbbe3a54a23d", "value": "T1EC734B42E652CAB3C8930BB6029B5B264A31FC3A1E2B9F59F31D7DF49B124C87217355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379950, "uuid": "ea4067f6-2f6d-4825-a816-32d231710c05", "value": "1536:0+xNVpyQWuKv8xKBnq5PeOj5zMLTamLI2VOCjXUfJRk:nNTI30xKBnq9eGIamU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379950, "uuid": "6d6ecd92-0774-48a5-b02d-3121a361b7c7", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379950, "uuid": "6d42843b-5808-4f3d-93c7-e819c115c8bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379950, "uuid": "d8fc8e43-3c3d-46e9-a5ec-c60dd0ac35b7", "value": "a51bf79a2693bc80beb56986b98ed1f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb956a9c-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380964, "uuid": "a43a11ec-41f1-46fa-b8f7-512e90882d49", "comment": "Malware payload (Gafgyt)", "value": "1db1e5e62f7af4fac405ecea91880a1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380964, "uuid": "31f7f969-b67a-4167-9d4c-9412800418d4", "comment": "Malware payload (Gafgyt)", "value": "511b238b1e66d28d7e6e748270acb22198ee61f3172e3aca452efec8842ab22c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380964, "uuid": "3acd7bf4-8641-4994-9fca-e8bae2cf6057", "comment": "Malware payload (Gafgyt)", "value": "d5bf07a4ef29939cc13a1abfcf552aa388d4cc43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380964, "uuid": "0b9453ce-8fa7-42a2-8dd5-d98e0c5f913a", "comment": "Malware payload (Gafgyt)", "value": "c68e0f34cfe6290f2cdb7bd139370949baa37ec22806990463c8a706cf6e5bf2f34ccad89d415df17f59cd6a94a81ada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380964, "uuid": "e9be48ad-6627-4794-9762-4bd5d146d22f", "value": "T14AF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380964, "uuid": "d5519a4e-0ac1-4834-aebe-20ba13616851", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBoYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/yYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380964, "uuid": "cf6e2a35-5647-4e61-9abe-053754e3a33f", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380964, "uuid": "0ff5664a-d2cd-4c94-a41f-fc3b001db362", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380964, "uuid": "4541c315-cf4a-4ed7-aefe-8cb2a4dc2aa6", "value": "1db1e5e62f7af4fac405ecea91880a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c288be65-2e6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634379660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379660, "uuid": "c6c7fad8-0872-470d-9636-4aebd3f70448", "comment": "Malware payload (Gafgyt)", "value": "1041783726316198b2fb4998da1900da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379660, "uuid": "81d9c088-9a81-4caa-b5ae-781f98afa670", "comment": "Malware payload (Gafgyt)", "value": "5365b74863fcf2940968187b5441f1ab6bb2a92e12714b2800a7dda52dc2299e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379660, "uuid": "5f8e684a-99b5-4bf4-8393-21cebf04fabf", "comment": "Malware payload (Gafgyt)", "value": "812eeef74112dd7b9e538639e8841ba9f081b0f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379660, "uuid": "1e61ee76-141d-4da1-86c9-392d19c6315c", "comment": "Malware payload (Gafgyt)", "value": "53cd9b21dca678880a7644e053fc64489d270bc267816e77f39f49adde6483211aa73993b8b9dd17312a2e3ea1e6d5ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379660, "uuid": "a30841e6-1c3b-442b-89b4-ac3f3fb24ed5", "value": "T12FC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379660, "uuid": "331980bc-627e-48e0-a83c-05e39cafde05", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpW+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EQ+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379660, "uuid": "efeb5574-b9e2-43c5-a115-22b8041f81ea", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379660, "uuid": "0fd6f4f7-2dec-4ab4-90ce-b16c13302d4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379660, "uuid": "d0cedd68-b802-474b-9489-ff0d57634ecf", "value": "1041783726316198b2fb4998da1900da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0173da99-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380625, "uuid": "85f5bbc4-6357-495f-b412-6b743228cc54", "comment": "Malware payload (Gafgyt)", "value": "d25c30d1b2e1e1f5a6a95cb851c6c34c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380625, "uuid": "ab69bbb1-da4d-4813-b1e4-cb16909d6805", "comment": "Malware payload (Gafgyt)", "value": "54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380625, "uuid": "f9b375a7-471f-40ba-b347-6700b18c4007", "comment": "Malware payload (Gafgyt)", "value": "97555dd8ea55effa0807f9e412d25b9e9bab6c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380625, "uuid": "3dff40ce-5d5a-430f-8d13-858272148189", "comment": "Malware payload (Gafgyt)", "value": "a8563d42e485cb23968b3074564952d36435ca67050a212159fddce396063415a7753f15abed2a9ba23fd9bc8ba932f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380625, "uuid": "84c6b8ee-9cb2-45c1-8993-36111ec5d4f3", "value": "T1D5A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380625, "uuid": "961ba5c7-8592-4c66-a9f6-6710631aaa58", "value": "3072:Vgdr2vIBAxMyAOLRcftxhOemuxVqDr78fz1e:Vgdr2vIRyAYcPhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380625, "uuid": "906909f8-906a-4b46-b2e2-2ba102a2abbc", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380625, "uuid": "4c5e886e-b86f-4b3a-ba1e-f6e5f3e2768c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380625, "uuid": "ff180b94-6f22-4502-b109-0a970a6ea355", "value": "d25c30d1b2e1e1f5a6a95cb851c6c34c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883a6371-2e3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634359806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359806, "uuid": "8b12191e-6bd3-47fd-b76b-855e4821006f", "comment": "Malware payload (Mirai)", "value": "8330e4d1e097c04294464141f7212bbb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359806, "uuid": "28997384-ecea-4ac3-83ea-0ecd706b1b2c", "comment": "Malware payload (Mirai)", "value": "552480d3989dea9bc33924b0251208ec87cfd75e3f9ffc2e74a1c35e6c3b2593", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359806, "uuid": "01b1f908-b9a8-4376-ba57-4ce8b364b206", "comment": "Malware payload (Mirai)", "value": "e4baaaa7d03e28cdb47162b9197d8cf5a4e16d05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359806, "uuid": "5cadc002-749c-4dfa-8394-5e303b67bdd2", "comment": "Malware payload (Mirai)", "value": "819948611f24d11cd4c088a42c301e36d6b871d47008da30a42512973ce242f1ace9a50d9050400e5a9c83e55b624037", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359806, "uuid": "c72ad626-49a2-406e-b57b-118bb8ce292d", "value": "T1DCD35D46EA808F13C4D527BABA9F41493323A754D3DB730689289FB43F86B6E4E37505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359806, "uuid": "f3938331-ca12-4082-8e29-8e912c959653", "value": "3072:83Yz7IVJbc/RDvaYJi7EZpzvhknsnlC2uAYsxqsEBZoeyKTE0M/9wZ1Le2:8oHAipDvaYJi7Ezanx2uAYsxqdZIKT7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634359806, "uuid": "5e29dec1-96d7-41fa-9fd3-053aaf2638ca", "value": 141092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634359806, "uuid": "67ad937c-e56a-40b8-8f4b-643d461fbd87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359806, "uuid": "6f68ae07-def8-4d9b-9ede-dddfb5dffd65", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a319a573-2e48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634365005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365005, "uuid": "4254e7d8-218c-4fd5-8392-b50d27c66a51", "comment": "Malware payload (Mirai)", "value": "ff4bb0b63ec89ec9ee30fbd4a8feb473", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365005, "uuid": "241ff96c-952b-4eb1-823a-e89498226bbb", "comment": "Malware payload (Mirai)", "value": "56569776753cf325c8a93c04f4654970e5d4ee221a7c890a24cc4a8edd3a40a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365005, "uuid": "b14b371c-5474-422b-8278-977877acccb6", "comment": "Malware payload (Mirai)", "value": "2a1a149ac709eed810a4d1b108493e9f25de189b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365005, "uuid": "d8dad91b-47b5-4f7e-9af1-dd3a06948d1d", "comment": "Malware payload (Mirai)", "value": "0c4fcaf202fb93610549a09457737fecbecf7567ae9609d1fca9f211d15cf725ae50c694d61243d9f703a521838f9c0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365005, "uuid": "295a53a2-2be2-4288-b615-3ef77b6df568", "value": "T1BBC2E170D10A8DB3EFBAFDB08B41DDE23F4A539E2892E8D260956B1907B243D55006F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365005, "uuid": "0d9d9c50-99f7-432c-b65a-0a126376f56e", "value": "768:z8xqNa7PqLefxslATOTIAA6Q7dHGKKdPBKp0+Ow/mX4uVcqgw09f:DNLaxsl8X6+dDePQwvX4u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634365005, "uuid": "86e01d18-aa41-45fc-a082-8488220fc054", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634365005, "uuid": "9d474980-7d62-4e37-b1e1-614435e45e7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365005, "uuid": "a010008f-18ab-408b-9de3-fc67242b0cc8", "value": "ff4bb0b63ec89ec9ee30fbd4a8feb473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8b2cda-2ec3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634417664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417664, "uuid": "83bca695-9af4-4923-b0d6-7587f677250e", "comment": "Malware payload", "value": "557894d353f5ed549761d17a537912c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417664, "uuid": "aab0ca10-7a8b-43d1-9ffa-d9854bb8e1f5", "comment": "Malware payload", "value": "57700bbf7260304d99b69586cc8e553acf36c4c3dd62032e069215ac35446a3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417664, "uuid": "13b71032-94df-4f73-86b0-f94835ff20d2", "comment": "Malware payload", "value": "6af54217d472ce3e05097629bd94ca9e3df4c506", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417664, "uuid": "1122d587-0e1d-4d19-ad1d-aeb3e1fa3602", "comment": "Malware payload", "value": "c2ea3c72c6e673623513311131583ac2fb56353b6ee0df38cb9b48efc8148003e5ac2db43d8ec236e8be8d71182fdd78", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634417664, "uuid": "9b81690e-a507-4f6b-8d31-d532bcbbbb4e", "value": "T1CAB20A374FD303A4878311B2F7599F9BEE5C411C3A0DEAA678FE014A1782968D537AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634417664, "uuid": "891a1967-dbff-499f-b4df-7c3728738303", "value": "384:aZSpU0/JmEVNsxSKDkQTiCibDU5YAx/DkQTiCibDU5YAxbDkQTiCibDU5YAxH:aZL3EGSKLiCib+/LiCib+bLiCib+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634417664, "uuid": "e0fccef7-c0f0-4a8e-a78d-b43ca9bf65d2", "value": 25508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634417664, "uuid": "4542816b-1bea-4feb-b6b1-2f53acf3ccd5", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634417664, "uuid": "47798fdd-0354-4976-b0f4-b696691bc724", "value": "Untitled.opml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01741958-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634396087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396087, "uuid": "60beaa30-7f7f-4e47-8a52-37827f222937", "comment": "Malware payload", "value": "481cc004b81afcb1ec10bb9985cc402b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396087, "uuid": "1174c2e6-03e6-47f3-8769-5abdac27e0f0", "comment": "Malware payload", "value": "589dcfea6f854dbc578b8fb3a4e65217137630f93cae05e3248942821947c02a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396087, "uuid": "fe183f4d-1cb4-4a06-992a-f4381cec425a", "comment": "Malware payload", "value": "86fcf5d85033fcd857c865df4fa1da51b6d53bf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396087, "uuid": "e68acac9-2f95-412d-8e33-baf9a3f505e0", "comment": "Malware payload", "value": "a13b51dea7b52d34abfff36e7ad623dcf7734c9cd50d77fdc55545e40830015554fa74a5491e595e5f17559f87f104d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396087, "uuid": "75e48cf9-9ce6-4c9f-a19f-197c5b83935e", "value": "T1589533CEA67605C4D84DCE3A26C44B5867D13CE9DFAA56B1DB72B5FCC83276232C8025", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396087, "uuid": "81eee619-37eb-4ccb-aac0-a79dfb5a5059", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396087, "uuid": "4565a4ae-4f75-4368-ab6f-77ee751be408", "value": "49152:utPKiXai6uqwoc8ZAgddkN9TD0GcIXfkRt2jN474os4:IB16uqwbGbduYKfWyNu4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396087, "uuid": "41e80477-cea5-45e4-812a-a910d8f4b303", "value": 2035712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396087, "uuid": "ea2965ca-6e1e-4fe4-af41-6a6efcc91d56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396087, "uuid": "38f96169-04a1-425a-b6a2-6b3d47db7563", "value": "481cc004b81afcb1ec10bb9985cc402b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fc2244-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634376975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376975, "uuid": "1422b585-12fa-46f7-8025-05b47b23f1e7", "comment": "Malware payload (Mirai)", "value": "f828457c929e2a687288f9fde3bbf680", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376975, "uuid": "f36d4ef4-bcb6-43e3-93fe-7fc515e366c0", "comment": "Malware payload (Mirai)", "value": "59f8ef9ba40a6c227e5148e681728bcdfbc1d4624873a5c9857523c3d64f4baf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376975, "uuid": "1330fba4-cf35-4770-8802-f5e8371dbf0e", "comment": "Malware payload (Mirai)", "value": "e6c9635f6226a95a34d0559326510f2918b95ca3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376975, "uuid": "df99cb1a-bd0a-4f54-a78a-b3218e3e73b0", "comment": "Malware payload (Mirai)", "value": "84f33663fc49b4e251afa7db1bbb0357559899ed8577657715cc6ae9e1a866fb30cbbb1963b6c10f8c92d8a23ba7df4d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376975, "uuid": "2a1daf4f-b839-4620-8710-e225fe47cdc0", "value": "T120D35C1B75D188F6C04285B126DB62508813FEBF0BA63197B7947CA47F398CA1E69FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376975, "uuid": "86092538-2150-4cef-8f67-0bcec0f79afe", "value": "3072:H1gfdQvmGHNhZOVUXBg9a0kTqMutJ8adPF4KQTjsRca3/P1veb+fcivGmS+kI:OE9XqoPvutJ8adPF4fGcav5eb+fci+m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376975, "uuid": "913c9bce-7011-4d67-a0b7-27399ceb8cdc", "value": 141155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376975, "uuid": "d0dca316-070a-4003-92a8-a987193f98a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376975, "uuid": "e99d5341-01dd-4c83-9d00-7387ea6de3c1", "value": "f828457c929e2a687288f9fde3bbf680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27b4d13-2eac-11ec-843c-42010a9c0014", "comment": "Malware payload (Alien)", "timestamp": 1634408061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408061, "uuid": "dbd1144a-02d1-4915-9fa3-4b5543a01483", "comment": "Malware payload (Alien)", "value": "33ff28072a93d566a99b79820e09ca2a", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408061, "uuid": "2f7e5ba4-0868-4cf3-ad5e-5afa50aec6e6", "comment": "Malware payload (Alien)", "value": "5ad9093d9349b0b87ee912eca2ed0a3b0b2d0cfba3ecffc8fa09142149d34dc8", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408061, "uuid": "2df6fc09-d85a-4b23-bf4d-01a96f7eb6c8", "comment": "Malware payload (Alien)", "value": "248423df9bc8dff47afa99d69584d908749ba481", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408061, "uuid": "a2c85a77-c89b-47e4-aef1-e6a780f2079d", "comment": "Malware payload (Alien)", "value": "f096d5c1cf3f00e1c24287a2997f5af743335283f794097c54bc200e39b96f481de34ad01ed40db7c9f88480be1c5b09", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408061, "uuid": "df0eff48-efc0-4d5d-b1e2-e929276c700a", "value": "T13EE533C46A6844EED323AC741EEF1241603C5F4622749E9B19C2FD50CBFB9A97929C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408061, "uuid": "8199ad79-4011-4b06-8330-6deba7f13bf4", "value": "98304:hES5Lig/pmLKPxlPuC0MMQ6Jq9UpNYDEcRH1Khl:h1ma8KPrG3MM5A9UjYDh1K7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634408061, "uuid": "682cd1dd-0506-4640-a32d-0f7eae945b3e", "value": 3236390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634408061, "uuid": "4033f00f-7581-471a-a6e5-e9f95ce4e465", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408061, "uuid": "a06b591b-036a-4c83-b5f1-f4590cda212f", "value": "k0ZWUDiuIC_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2366a43f-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350187, "uuid": "e37e5ca0-929f-4334-b015-4a2b444f74b4", "comment": "Malware payload (Gafgyt)", "value": "4c9499fd8268353375784aa539bc3b07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350187, "uuid": "aa8454fc-5714-4fd7-a9d2-ba642363a361", "comment": "Malware payload (Gafgyt)", "value": "5cf565152d8c9645fe73811288aeb0fc51749ca74a818b4e0f08117baf58bb0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350187, "uuid": "911f07c6-1001-4355-97ef-4fcd594631ac", "comment": "Malware payload (Gafgyt)", "value": "37764de27c93dae3ff7aa3e9d66206c40b224fdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350187, "uuid": "88865f5b-5484-4d96-97a0-5d21b263be8d", "comment": "Malware payload (Gafgyt)", "value": "398a6cbe177079824bdd4899f27053050df3d4fcf537649f030f82a6cf35894e607a1ba3e071b8e953659f190a10d0f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350187, "uuid": "6568921f-69f8-4c16-9890-535c957aacb5", "value": "T1C2A32B40F8418767C3D327BAE78E478D3B355A9467D733116A38AEB42BC1BD92E29530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350187, "uuid": "9406389c-5852-4fb8-8229-94b270a1fc82", "value": "3072:i9zDIhZcPekFlbVPPPZo0rmtCqQ4DPw7XSss:igqPXrVPPPpmtCqQ4DPw7XSss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350187, "uuid": "6811f205-7cf8-457e-9d1f-d1abdc60a321", "value": 105169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350187, "uuid": "c0a3d1b0-223f-4db4-ab2c-72058c0db877", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350187, "uuid": "1f343756-ef15-4539-b043-ae6ff9dab044", "value": "4c9499fd8268353375784aa539bc3b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d86942-2e79-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634385867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385867, "uuid": "34f71a0d-683d-495a-9b75-b21099ba2f92", "comment": "Malware payload (Gafgyt)", "value": "8b3fae9e8680e097451b0e98657b24f3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385867, "uuid": "996ce7f3-24d1-47d7-908d-25f34ef8363a", "comment": "Malware payload (Gafgyt)", "value": "5d8764509388375ec4ebd3a54b9faf5d471f942bcd3f563b5bd7567a01a9c0c7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385867, "uuid": "f66f0cc0-928e-42a8-a0b6-e24f6887cfdf", "comment": "Malware payload (Gafgyt)", "value": "739b5c972b9feb36ad3c1aca49845566568faf62", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634385867, "uuid": "7ee9cffa-3b9c-4442-b05c-68dd7776debb", "comment": "Malware payload (Gafgyt)", "value": "fd21dff031907378500d1dd243fc53499bc518fb5e9093fb2bfec9bc26980512e715d48a9b01617d639771f6482dd1cf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634385867, "uuid": "9d3e16ab-e81a-4eb4-9daa-3a435a93ae58", "value": "T1C51302DA424EC978D93CBCF716FE5A80DE56BC05A503665B0D81233EDD5AA886E220E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634385867, "uuid": "23d308db-6c47-4676-9310-f056706a2a68", "value": "768:ioOeDv/AebPq2qtSj4M9u4TyiLwsEfEy63r5ex9UIssv9sPPr5tgZDIioEC:iSDpbPStY9Ho5G8wcFuxsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634385867, "uuid": "2e10b085-a693-4ccd-84cc-d2b8d4d37032", "value": 44744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634385867, "uuid": "e9f726e6-4945-497a-87c3-18cc5fe66a01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634385867, "uuid": "e2b7667f-4f5f-496f-86e8-b462a45a2250", "value": "8b3fae9e8680e097451b0e98657b24f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e172a70-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634352970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352970, "uuid": "cbb23396-0750-46a3-988a-577b8b9083d6", "comment": "Malware payload (RedLineStealer)", "value": "78674b261fbad461ebb0375ccae004b6", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352970, "uuid": "fb22d929-44f4-4011-ac38-b0d56c1a6bcc", "comment": "Malware payload (RedLineStealer)", "value": "5eff7e99184b9c8352125aaf8aa9d72e33049c52dc4eb7a69d509da3e7004cb2", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352970, "uuid": "418de992-3493-46a7-b496-6f9aacea5a62", "comment": "Malware payload (RedLineStealer)", "value": "34cd2e8ff2528e3b766e0da7c08102c0bcee638c", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352970, "uuid": "aab2d086-2eb5-4cf0-83ea-8fff243d06dc", "comment": "Malware payload (RedLineStealer)", "value": "779a8808dd8de35c521e8480fd335e2be0d9d3db9d4b1bacabb01792b69b60b4bfc3fb5fc2afe650429ad43f9dd1ca1a", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352970, "uuid": "d0b52e8e-d3e3-45ab-a1b1-ce1c85d5fea2", "value": "T1CB548E10B7A0C034F4B756F849BA9379E93E7DB19B2494CF52D116EA4A35AE0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352970, "uuid": "8a89e145-df10-4719-bf0b-098b4be2fb30", "value": "8d9ee1d37ce0771b137ef02c8f52b4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352970, "uuid": "e067f5ce-8650-4b6c-abd6-7b000e0e0c8b", "value": "3072:T5L0JSLyaD0HSBi4IGVHzg3zS3lc6WR4dGKrUi6zFMTc8a6G5jv2/8R8ZreJXMfH:yyBiVUTa6WR/KrmzFMIX6GlA8Rsow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352970, "uuid": "df16faae-be27-4165-82d4-125b3771af84", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352970, "uuid": "7cda7808-4123-40c8-87e5-04e2f42ca6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352970, "uuid": "9fafc618-feaf-4042-8710-050be051ea12", "value": "g1UitnVSXkY82jcpWYJ4Y9yL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fc6c59-2eab-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634407340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407340, "uuid": "0337673a-8365-4e37-85af-93fde092bde8", "comment": "Malware payload", "value": "0d00d5fc759ec02252080b3906e3f1cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407340, "uuid": "096d444f-f4a0-4f60-9c2d-bb2386f1a7f5", "comment": "Malware payload", "value": "5fc07812cd80bb4273446753112cac81eef82e13b51a00f9d6f918833b539cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407340, "uuid": "bd83061b-b4d8-4188-91f9-b952765c795a", "comment": "Malware payload", "value": "ad728009d1b3b757dbbf0505b8040864a6837bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407340, "uuid": "9ce2acc6-41c8-4f80-9ac1-bf78a0cc2e1c", "comment": "Malware payload", "value": "d5946e5168892bc7d0000de9dfbd859327f3896b5a70ddbc43a775e05205e84c2adc4152cb0babf856ac2616a4ae7664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407340, "uuid": "2b24aad7-24a2-4508-8f39-d440ef20ce98", "value": "T13F15AE4BF36042FAD06F513189CBC677E3B076A91A35A72F4290D9DD2F339126F1AA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407340, "uuid": "fd532c17-7678-4f2c-ac8a-ca39e534905a", "value": "045715ac29c84a0e47dab339e337bc06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407340, "uuid": "2b2fb9e2-40bb-4304-b97a-abef12034417", "value": "12288:jx1vJopzeLkTqhqeEmC7sOSafeei7fq/Hf:HCzIkTgqeEVsOffesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634407340, "uuid": "3b3f40f9-ae92-4141-a9c7-e09b2f90c3de", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634407340, "uuid": "5dfc5b3b-56e6-4273-9fe3-84fa348fce14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407340, "uuid": "2b0fc694-03a5-4330-ab80-83939608de72", "value": "0d00d5fc759ec02252080b3906e3f1cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d77102-2e7f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634388606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388606, "uuid": "971b068b-4e65-49a9-9f41-e68925ab7e6d", "comment": "Malware payload (Mirai)", "value": "099fc6229f02b8df926f550909079db2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388606, "uuid": "b1b45e76-31b7-484e-88e5-3792213199ad", "comment": "Malware payload (Mirai)", "value": "621b11671612af4636bd52cc13b4b0799bb6f42e3a92ca2c6ff3ca34656d2c0f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388606, "uuid": "90dfc175-b5f7-4353-86f3-32f9e53313e3", "comment": "Malware payload (Mirai)", "value": "28d09a7ac91ced593d1934dbc3dc2357424d8ac8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388606, "uuid": "b496b505-960b-43a7-be42-d8334a4fb222", "comment": "Malware payload (Mirai)", "value": "569b5fa5afd7f55a7ba22feaf06069e3ecc6a8256a104fdc72007938a599481b0d59dc7a51b7b5ad90f4bd1d1f415e88", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388606, "uuid": "598ea421-fb20-41fb-aa22-0cd0558d6a88", "value": "T174B2C0717015F8B7C7E600B76EEDCA43FB811AFCD0E8B3295465099DEAD5842AAF1107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388606, "uuid": "280dab3b-e347-4450-8435-b87d07522e73", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pbgs3UozG:5tn+o9wjfBAZxzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634388606, "uuid": "73670fce-3fc6-4d97-988b-2bb44d752b11", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634388606, "uuid": "3607606f-4cf6-4378-8281-3ae4d7911024", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388606, "uuid": "fecbc9aa-65eb-4639-a4ce-ffb8b40035b3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd52e42-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634396106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396106, "uuid": "88ec684f-e917-4549-b3b1-61f103cb0c89", "comment": "Malware payload (Mirai)", "value": "e05bb32a5fe2713dd80a65b96c8812cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396106, "uuid": "1a654e7e-83f0-4a0b-a0bf-d5793aa0f455", "comment": "Malware payload (Mirai)", "value": "676c51b97b210ab5ddb00e79182bf7f9b13bff8c4c4fc7cfa995ca665d28bcfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396106, "uuid": "a194bad3-4858-41c8-bfd7-bbcf16166b78", "comment": "Malware payload (Mirai)", "value": "1c26512a1a106439ceeeb7ad51951aba26ac3606", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396106, "uuid": "471c2fee-201a-45d7-b082-5acb07fb6010", "comment": "Malware payload (Mirai)", "value": "af8345399783b53d96e9654f645a74a39510e5e9e3a4a4647a1c2b181df2364da80f7ef1b6f582ca16428d9d549ef793", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396106, "uuid": "4e64780c-e786-45ed-a4cb-69697ce47fb4", "value": "T1F66412ABD9777D8FEE0B4FF021A70E4A1AF9D6D6D2C658907325048439FD342A2607C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396106, "uuid": "c9cb294d-4c2f-424f-8783-730103c0c5a8", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396106, "uuid": "38ec6f19-7064-4824-b184-59750ac5a273", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396106, "uuid": "6abc3c15-4646-4517-998f-e13433410425", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396106, "uuid": "1d4c9a8b-f4e2-48b4-a998-6024a4189596", "value": "e05bb32a5fe2713dd80a65b96c8812cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241df284-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393138, "uuid": "51b197bc-ced0-4575-ad37-3539fbe2e072", "comment": "Malware payload (Mirai)", "value": "9cce732103af09cebb3b5e1dcc567817", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393138, "uuid": "899e973a-0d95-42f1-9bc1-8e7700a86aa2", "comment": "Malware payload (Mirai)", "value": "6af4f152433044b3ce397e98a75053d9c6064d204efc17048856dba8c9197d24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393138, "uuid": "afc8ab8f-0d79-45cb-b4bd-09e3ed7155c3", "comment": "Malware payload (Mirai)", "value": "2183ecfa841a70f431670c40f21e71e0ff90f198", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393138, "uuid": "c6d78ea9-df0c-4129-b6d1-93418d112266", "comment": "Malware payload (Mirai)", "value": "76bdcb926edca64ed34263be96231db298d3bcd53c53efad38826948aef78ef393f38fd9bff4c832f8c9879b180bf2a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393138, "uuid": "562a23d4-5a94-4fec-b3f8-8031f5b7ae00", "value": "T1EA43195ABD918A06C9C46277FA1E01DD372563ECE2EE3303AD162F6077CB81E0E76156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393138, "uuid": "c3b89f1f-2b68-42fc-9b9f-9290cbcdedc8", "value": "768:HvOoZWijy4eVlhZSpG33+/iKB9dk3VsJ62jBOP2siLNR0HGnWENsicM/+mBNOzTE:PpzythAm+VBYVsJ62jB+KIis3YfZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393138, "uuid": "d2c1134a-7173-49af-b159-4a27742246d2", "value": 56164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393138, "uuid": "e58bea43-4f1d-438a-9bad-8508aafa0921", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393138, "uuid": "b07eea39-f730-403b-95f6-29322b12bc94", "value": "9cce732103af09cebb3b5e1dcc567817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a3bd7d-2ed8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634426890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426890, "uuid": "6e184438-22aa-4ac3-8c85-c981dfff0cce", "comment": "Malware payload", "value": "e7d3f7d73daf1510524df4500970d48e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426890, "uuid": "2b6132c2-f387-4499-a076-aae38616d7ce", "comment": "Malware payload", "value": "6b456612aa2e1bfbfed6f7629a0f771fa42c95e0547739631ff5740715205184", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426890, "uuid": "00d454b0-cc3b-412d-a218-2b4632e8d1f8", "comment": "Malware payload", "value": "eb44024b2a601dc5663c855b51e2c07db00ab336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426890, "uuid": "172aecfa-a69a-40a2-bf7d-8bdbc8257046", "comment": "Malware payload", "value": "09b958f6f3842212139114906defdbb901b94953da5b5b103d2167619a6b05916bf53f3c1b7dc9f6ef6a38efb80f32c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426890, "uuid": "e4c4a7ed-3c55-4a69-a402-70c47c1843fd", "value": "T166C3451869BFD069D0E3EAB22EDCA4BAD99A54D3140D74371074733B8B62B80DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426890, "uuid": "b2c09f85-500c-4fb8-9808-5acba13c12ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426890, "uuid": "07c84e9c-c3be-4176-85e1-af1f8635495d", "value": "3072:VccMMQbv+vX26wUkjHQHB7+Sm8uGuQZ8LvSjjPGm/DKlIKHDsNHcjpOkidwUiFvl:o8uGuQZgvSjjPGm/DKCKHDsNHcjpOki/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634426890, "uuid": "9982ef3e-6d7e-46ee-bae7-517120d3ee4c", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634426890, "uuid": "acef8a14-e875-46ba-8996-bb5ca3c52f54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426890, "uuid": "2af16b4d-55c4-4378-aa7f-106d2f8d0a12", "value": "e7d3f7d73daf1510524df4500970d48e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74563863-2e6e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634381247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381247, "uuid": "2ff5ae4e-c86a-4d5d-9715-bfb4c75c8bd0", "comment": "Malware payload (Gafgyt)", "value": "0df1d5e2a6f7406eb646c9d053651f6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381247, "uuid": "e53d4250-1ff2-4c7b-b1ee-0ab57a62a425", "comment": "Malware payload (Gafgyt)", "value": "6b6ea50e30fbd53bc24af5d3712d6e865e30ef29ff78dc117d98e39ed566e23b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381247, "uuid": "77aeb2ec-3d66-45b7-a926-12a9d50f7c28", "comment": "Malware payload (Gafgyt)", "value": "7ffc550b205caa1cca35e3571287359408246b18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381247, "uuid": "601528c0-3f7e-4bf7-8d58-741d3c2a7897", "comment": "Malware payload (Gafgyt)", "value": "a1bfac8c53a24aa3fdfb6dbfe815b41d456b74d6bf938b66b59e8c071e89f81477a0b8d185f1f0298663bf3158c284c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381247, "uuid": "554c7bc4-636d-4a99-8dea-e8b3df4460bd", "value": "T141833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381247, "uuid": "87417a31-c4f7-4c99-9a06-c1f3268351bd", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCUdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JfBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381247, "uuid": "f112570a-8f4f-40f8-94cf-64a4d2e7e4ce", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381247, "uuid": "f40c86a5-9e00-440c-b3ca-7f310c35f05e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381247, "uuid": "03435152-135b-4273-a582-b74eeeef4756", "value": "0df1d5e2a6f7406eb646c9d053651f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf1a2b2-2e6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634379649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379649, "uuid": "ba4d5f38-666f-4cdf-86c0-12e190e5abb9", "comment": "Malware payload (Mirai)", "value": "6720abb7f3daaad51ec6ec60aa5e2abb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379649, "uuid": "c6963c41-bb9d-45d8-a9c9-9303b798c3fa", "comment": "Malware payload (Mirai)", "value": "6c2b844f6a8422bb091da69a69ec5844cb6ba3759088cf9b35ae367207068ceb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379649, "uuid": "d4024568-d2b7-403e-9a14-d1a8a430b7ff", "comment": "Malware payload (Mirai)", "value": "9a47f619c26c7e3e2bbc30edba9d04df65d7e0dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379649, "uuid": "3efccf5f-4fa8-4283-9cb1-451a79f722f7", "comment": "Malware payload (Mirai)", "value": "9293389c73a6cab92bdc7df18f279182bc686034239c8a83014bd92f265f968adffe6e8a95bc311f8123cce7894ed6a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379649, "uuid": "83b98c08-a310-4832-9a6a-3a6c4e95ab62", "value": "T19B234AC4A553D9FDFC1A0A742173EF729BF6F53E2128DA83C7A999339882702D40619D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379649, "uuid": "f95a2ba0-bd46-48d8-8b99-2026b3e692a2", "value": "1536:uUQcvssQ5ULlCCJ5j/OgXhUofjY09MdE:WcvssQ5UlCC7j/Oiiof8Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379649, "uuid": "be810085-99e0-447c-aaa7-65f327def596", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379649, "uuid": "a302ea1b-59a7-47d2-9527-99c3b69b49e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379649, "uuid": "3eab2812-af61-45eb-856a-34231b55542f", "value": "6720abb7f3daaad51ec6ec60aa5e2abb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8bddcc-2e6e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634381239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381239, "uuid": "a4ed8447-15ba-4613-9e80-a6e32187dd58", "comment": "Malware payload (Gafgyt)", "value": "a4b47c35478a7f45ae7598481597e743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381239, "uuid": "82539111-92f0-4222-9731-2846c794091a", "comment": "Malware payload (Gafgyt)", "value": "6ce166fb0b6a308746a6309b74cfa7f165340e22ffdca4b9712d8df04338e4b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381239, "uuid": "1cac737d-814a-4026-a45d-299ad6296b70", "comment": "Malware payload (Gafgyt)", "value": "4fd01ff62a0512cd364b72317d58bb1d27397395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381239, "uuid": "93a16b98-cfe8-4a2f-ba8f-1c0728a80ee8", "comment": "Malware payload (Gafgyt)", "value": "8b2900c0935aacf71129709f6567ceaa8ab1d3e807401dd9608923e82dd96c6f164bff90f364dac999a89222afb38ffd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381239, "uuid": "05d96af3-46b6-45af-96e5-f9246737f593", "value": "T13A832A43B72D0B43C49B6AF12DF72BF087A9F96117A76180A10EBFC45772AB02512F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381239, "uuid": "0c95f578-12f5-484e-8116-e3c77515cc07", "value": "1536:tQe/XQMozMT/aj5ecEo39igRNaMo3y6VZCEmQ9VqXjtWf2Xe:tNZrSUcEo3tJKyyCEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381239, "uuid": "a6918f22-0d01-43e0-acbb-32a30c7143b6", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381239, "uuid": "f8843d72-429a-4794-89dc-7675a51d95e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381239, "uuid": "721ce442-cccf-424b-8224-5382fff44e7d", "value": "a4b47c35478a7f45ae7598481597e743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c7266c-2e71-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634382486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382486, "uuid": "879b0b51-1df1-4985-b6d4-78da8375ef9f", "comment": "Malware payload (Gafgyt)", "value": "ca9549d4ead3f33d52b05f1bdd727c82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382486, "uuid": "59105747-baa3-4cb9-a88f-5640164343b1", "comment": "Malware payload (Gafgyt)", "value": "6fa061c48cc4af849516c581bebff871f2d0accddf269abd83ba189ffdd8d5c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382486, "uuid": "3ad36b30-0410-478c-8df8-89c700764b21", "comment": "Malware payload (Gafgyt)", "value": "1dcf556b88c6242bae3e11e170b37e94c1c5e8b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382486, "uuid": "f25bd8bb-1b83-4cf2-86ba-5c9a8a5640b3", "comment": "Malware payload (Gafgyt)", "value": "affa181002de364e4622dc3cf762342d3edc4f0bf441d3465776e2e7e62e35d5b0493911133175fbb637ce7ede0a9c56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634382486, "uuid": "d0154ee1-de63-4526-8cef-2efab1fb0d91", "value": "T15613E0A591B146B8DA3D203614FFBA965DE8126C980C27D2AAC933B1CD63F151F1CAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634382486, "uuid": "1769a120-5bc4-4ff6-ab8e-33aba248944a", "value": "768:tBeaP3gGLMTfha4rIq7VZZAEEj524pWzcMJxuOXQbrhnbcuyD7UryqBxP0GMdio:dRarnZ+Eew4eZbAbrhnouy8mqnhwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634382486, "uuid": "38307b55-1c75-4aa8-b648-85ddb91ce916", "value": 41524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634382486, "uuid": "c3a4619d-3a0a-4229-9783-7d8a77871117", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634382486, "uuid": "564b63a5-6f1e-4286-8798-ac039a8d3e55", "value": "ca9549d4ead3f33d52b05f1bdd727c82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba942d8-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634376964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376964, "uuid": "d2282645-03a0-4843-bf6b-2d7e4789361f", "comment": "Malware payload (Gafgyt)", "value": "c595a5469734d09f890fee3976d38b7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376964, "uuid": "a074d073-6332-4525-99db-42dc866584c4", "comment": "Malware payload (Gafgyt)", "value": "72efdc2923209c9e0b5647e451c8b8ea505c39dfb6ab029f62857ad2a77a965a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376964, "uuid": "070e6d35-526f-46a5-916e-a23d909e06b2", "comment": "Malware payload (Gafgyt)", "value": "c4ea395c29c80846f5208997332cc128899d8a8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376964, "uuid": "744b70dd-f5e6-490e-8240-be722b301503", "comment": "Malware payload (Gafgyt)", "value": "e556873219426b3948154d01f9c040cb380ac57b1b88f83a753ed7facebb3e565dbc24d81ea654839ecb3dad76eb4a30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376964, "uuid": "35ba47af-9813-4d41-bb16-5054dbe74848", "value": "T1A7E33B3776230D23C0C5547112E72331AABADFAA28FA22D7F9917DA86F359443126FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376964, "uuid": "6bb9a642-170e-4d47-a7ba-428ba6514425", "value": "3072:TMG/sKkktFoPmB/g3utJ8adPF4KQThsZQKn07brSQ0VGngfBI:4rK34j3utJ8adPF4fc7n07brSQ0gngfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376964, "uuid": "0cacc272-9b06-4761-85cd-0b53ab4145ac", "value": 151826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376964, "uuid": "bde37f0a-eaeb-4afc-b4eb-64aad05d7421", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376964, "uuid": "c087d356-5e75-43cc-a375-b7ae89b73566", "value": "c595a5469734d09f890fee3976d38b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5e4828-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634353045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353045, "uuid": "1514dac0-0366-4903-bef3-9c22a49ff342", "comment": "Malware payload", "value": "a0e02b25f547c31cd933bd65c7b93bfc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353045, "uuid": "ccfc39f6-706b-46d9-954b-4f17ede6d417", "comment": "Malware payload", "value": "735df6e71bd2fed57899bd61ba339bbccefd3d7971dd42ede8670d1bbe10e57e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353045, "uuid": "dee0162a-668d-4f9c-9ea1-eeef2820d550", "comment": "Malware payload", "value": "749df751a0607f85ad1ef83eb9991050d7ce20cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353045, "uuid": "0ba50a89-609e-4660-8b2f-daf75def52f9", "comment": "Malware payload", "value": "3fb28d0c9abf865dc85b47c21bef41eba90373fb8f44282303255e93898e0c1426f0b7076b0cc6fbdf628c1794eae400", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353045, "uuid": "6b2f5906-2df1-4dd8-b771-004b5419437f", "value": "T1AAD38D44B591C032D5AE15391835EAB19F2EB930EF748D9F7B441A3E9F202C1EE2593B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353045, "uuid": "f4f09563-0763-4efb-ae9e-07cc4ba7e101", "value": "262abcdb477951d302113004ddddd144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353045, "uuid": "dae0b678-2a01-4bd7-acad-4209c69a2b1a", "value": "3072:q7aNQLyh1AAItPJR+3e/a/rBH5nZ2KYGUXp/Ckj0uxYSrsNi9TMc/Tg9:qONQehv5DBHxZ22UX1wuxYmU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634353045, "uuid": "ede3ac1d-3f9b-42a1-a27c-79398e73eaf1", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634353045, "uuid": "41d0fd7b-4405-4c4c-8dd3-0e4078d64ab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353045, "uuid": "9b302165-f3d1-40e1-9bba-701b95f7131c", "value": "pidHTSIGEi8DrAmaYu9K8ghN89.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685c33f9-2e6e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634381227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381227, "uuid": "a86baf91-1261-4cc0-a4d2-80234fe25f13", "comment": "Malware payload", "value": "a6ff1021f24fe3576ca1056bd4afdc65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381227, "uuid": "3844e73d-0c63-481e-a319-9dbb9116f6c1", "comment": "Malware payload", "value": "73ab369c827ed1cfb5c6449a1af070ada5d574c0e94829ce4c1cf33152dc4c68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381227, "uuid": "ebf28dba-81dd-4a7f-b001-2e292d080668", "comment": "Malware payload", "value": "165e9df9db85151e822341e982c0486dfd07fdba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381227, "uuid": "98f65112-e7f4-40e5-9d57-2ba44a961a1e", "comment": "Malware payload", "value": "134df806e07145335bbad3bbde7ed479c43d20c4f5eb72648e683863bf2ef2cb46ef8238d19e708067570fa939faf14c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381227, "uuid": "611d9a04-74a0-4569-9780-50c5e4417346", "value": "T1F113E120028B7D71DD700AF2926FC58B6714063E44C1D6E29B1886FBDE1BDF6A379B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381227, "uuid": "2b7fede5-eee8-4fdb-af2f-68046470f797", "value": "768:eanAzXk9YbgWkz+y3EyYnhet6a0Z4jJxnLyWwmDXDz9EFrx3UNOij/aC:dcXkublkzR3EyELZEJxrweXH9v9jV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381227, "uuid": "d5882b3b-5cd0-46c2-8a23-3e0dd3864306", "value": 42148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381227, "uuid": "00ef0a43-fa98-4e27-b954-6d96c5d72783", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381227, "uuid": "b6549c5a-dd75-4cb6-9fe9-379dfb099c41", "value": "a6ff1021f24fe3576ca1056bd4afdc65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75db2223-2e73-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383397, "uuid": "01e16ebc-cc1d-41aa-a653-71474edae078", "comment": "Malware payload (Gafgyt)", "value": "d0be00fe218d50960f6dcff7847fee66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383397, "uuid": "9fc80ad3-204d-42d6-bdeb-90c79afbb34a", "comment": "Malware payload (Gafgyt)", "value": "74eed23bbd2e04b2694386cddedf8b4f0e7334c9be2bff9c9a40aeb28806275f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383397, "uuid": "df1ab2db-67e9-4689-a688-3a8921132fb5", "comment": "Malware payload (Gafgyt)", "value": "f5871f734d512484465de616efb196aabf5291b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383397, "uuid": "b4c33d03-0353-4b6c-a0bb-473670c5a763", "comment": "Malware payload (Gafgyt)", "value": "8d29207d436486638244e8a9dd2be53bd1e0e33ea58802562367c751653f67c8f5b22ac01a36cc86d260d6feaf79ec1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383397, "uuid": "c8c00d65-7fe3-4956-b186-779f65d4dbdf", "value": "T1CF931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383397, "uuid": "9cda3fd8-84f3-412b-8db2-a9dca14ff6c7", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvDNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGDNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383397, "uuid": "acbe2c68-1ae5-45fc-a700-98a0582f8be5", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383397, "uuid": "4e7b539f-7ec5-4518-8d26-10955c8e1d95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383397, "uuid": "ba77c707-10fa-4db6-85e5-013da0f6ca5e", "value": "d0be00fe218d50960f6dcff7847fee66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cd23a0-2e63-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634376384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376384, "uuid": "c0644fc0-b413-404b-b031-1c4246a9a336", "comment": "Malware payload", "value": "7eed95d504a1c398152202fb67e2a035", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376384, "uuid": "da809dda-341b-44e9-8178-1bfafa511a67", "comment": "Malware payload", "value": "754315d8d79048f5eb0f11d3b7039febed91936bb805b0d7d1ddc0bae7ec020c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376384, "uuid": "752ea76c-7223-4449-be6c-515a4cecb910", "comment": "Malware payload", "value": "ea5d029c750ade6d2baea5da71f6148ba702ee21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376384, "uuid": "0928bec7-9c7f-4ab0-a968-b5dad9542869", "comment": "Malware payload", "value": "70a305d7963268c5570753cd3a5ce104f5da264ae64f6506615c9757127f7d3699294cd4b9a51da44afc0d6073ba7830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376384, "uuid": "40bd1da4-47c8-4f32-ab6c-a4d6555f1804", "value": "T19F936B10B5E1C471F17319352976DAE15A2EF9204F259EEB379C026E0F340D0AA3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376384, "uuid": "7ffea3c0-e748-4699-9010-5de4c586c776", "value": "b4f437d48e25c7b06031cb97b5e20cd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376384, "uuid": "aa128682-548d-44f1-8583-2c5e7f3f920f", "value": "1536:87MGNViupm7ir2Ooe+JciT1GdeYH2JaGdVtcrYxam5+s8jcdahWfM39P:872YZoBPTcYYH2cG6r4J7gWU3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376384, "uuid": "5cb5bf43-3997-497a-9b74-6599f703aef2", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376384, "uuid": "d5f19636-36f5-4089-8712-ae5b6fe1f856", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376384, "uuid": "858d8640-ee13-4c27-a07b-cf5805cc2f87", "value": "7eed95d504a1c398152202fb67e2a035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69d5442-2e87-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392203, "uuid": "1729d201-ca64-4715-babf-457f3002d4b9", "comment": "Malware payload (Mirai)", "value": "886a6019511d3d0a9ddb7f83f3abf9d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392203, "uuid": "a57226b4-2c88-4d1f-a3b7-ea68f5b61543", "comment": "Malware payload (Mirai)", "value": "75d2b99e4792bbfa856be058108d30c0cbb7c07b2b656c54e80cd82fd25ad9a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392203, "uuid": "3de3ec02-7905-4822-9ff6-4fe2c9cdaab0", "comment": "Malware payload (Mirai)", "value": "027e5aca209bbfe244a6b05b189122ea8904123d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392203, "uuid": "64b3aac8-73be-4d11-80aa-1bb2e4497b94", "comment": "Malware payload (Mirai)", "value": "8d8d5cfda6b572b36f3b2a47317ba905a035354826fa6a3f29798695c28fb7b08cc931a0733a8aebcc26ad84d5db97f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392203, "uuid": "ccdb531c-9a02-4f9b-a97a-4e82124e4591", "value": "T1BDC2E1B4FA1C6979FF6A0277205320AE1265E511FADDE28D10EC4C27C67960864F9AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392203, "uuid": "d63209b4-1ad3-4bc0-a9d5-a6f27bf4733a", "value": "768:Ru3le5qtrpgIQxD6YzpH6ktyGsdLsFkkaJdG8Ho2j:u0qtlvs9oGNkkabxHo2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392203, "uuid": "10d2e88e-a242-4ddf-be77-e3e03ba30d9f", "value": 26192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392203, "uuid": "b0ff103a-3253-41a5-958c-31db5fe6e5c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392203, "uuid": "c711ca1a-8819-412f-8819-02c9fe9b1b6b", "value": "apep.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fb3b02-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634380639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380639, "uuid": "dd60f981-0769-42ff-a140-af15103615f5", "comment": "Malware payload", "value": "f2576f1b51907d739fd771ee3587e486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380639, "uuid": "5c89e00e-1646-463a-a638-93488735eefd", "comment": "Malware payload", "value": "77901a46681386cb16feb1772a4847c69c1d914f2657a1729fe65a774cfd0106", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380639, "uuid": "e4453c8e-a408-4b9c-80c7-53f02e9ff344", "comment": "Malware payload", "value": "16f4375cbaeac2809bfc8f9e52d0f93b1fef483d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380639, "uuid": "483938b3-b701-4994-b0fe-02a687911a0f", "comment": "Malware payload", "value": "830abf53b3b8d6fc0625693232e739cb33a90ceae8225f306faaa52572cb7c447a2cf631bcda6ecb057f9adb890740b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380639, "uuid": "750b4551-53bc-484b-ad4f-f7c7dcbb2b0e", "value": "T15C5302636A9199D2ADB05D78DF3D404BE3130DBF03B970B812A0FDF596214D6877A684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380639, "uuid": "7763a94f-f2a2-4db6-9d4d-35a19706cac8", "value": "1536:isxzJhUFYzfeBQ1J0dcxqxYMqintRICwrFKio+hx:RHC+0dcxiYMPtRICwrYin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380639, "uuid": "17d1a516-a905-4a4b-b169-f8a9f3cf1e09", "value": 63548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380639, "uuid": "e1ecabc8-7c31-4aff-b086-320ead9e979c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380639, "uuid": "d6295941-15fc-40cf-a730-b46d53029860", "value": "f2576f1b51907d739fd771ee3587e486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6090a780-2e8c-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634394099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394099, "uuid": "986afc69-1d51-4318-af97-2a3faaed7737", "comment": "Malware payload (Loki)", "value": "fc0a293c2c8c94e0d335ff5012a194f0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394099, "uuid": "39e015df-86e3-4be7-88d1-67af6876454e", "comment": "Malware payload (Loki)", "value": "77ada8345e7bd235de0c3660ce802f3b8105da41e16b6cdadd2274d53f42df7a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394099, "uuid": "8bd6b10f-00be-4a1d-bd2d-e03fe9294746", "comment": "Malware payload (Loki)", "value": "9e63213e36590df2d146fdea7b21902136b27b73", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394099, "uuid": "48be1765-b4a3-4b5b-b57c-7faf274124fd", "comment": "Malware payload (Loki)", "value": "7e99ac424980d06fbb3d3eb9ee99dd1c3941b55b2506a93a705de3fa46e7f2485242ab2288851775084286fbd3cb2f95", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394099, "uuid": "7baabb46-7ebf-40da-b1db-d1b5e046fe77", "value": "T12305231423A1530CED7B0A728875606043F57D9EAC61FE7D5B4238AE0E7B7520E71BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394099, "uuid": "fa9ed017-4be1-48aa-bf6b-38b641f76488", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394099, "uuid": "b0140cd6-5ccf-47ac-b839-0b0b4b41f559", "value": "24576:k2kBiad50iXd37pf4HVchOe1lFQb/CoI18:IBi8FI1cFvQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394099, "uuid": "90875dcf-8953-4f12-ac8d-ad8f7eccfb3e", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394099, "uuid": "7b4ab171-cf06-4d4f-a28b-70ef7bc729ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394099, "uuid": "0ece2973-721a-4a71-8f6a-8766a361f31f", "value": "DHL SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96abfe24-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (DiamondFox)", "timestamp": 1634352958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352958, "uuid": "89adf48f-5453-4e58-b7bf-d2b5c45ba33e", "comment": "Malware payload (DiamondFox)", "value": "cea79c8c0197da2beffd188a31efb31e", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352958, "uuid": "e633d403-8f35-46e8-bcd4-f6fe1cd9d47b", "comment": "Malware payload (DiamondFox)", "value": "77bdc94b3e90f3d4df5ca299e563e8425b6dd7ec50e0fe6fa697e87b1926f778", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352958, "uuid": "69dd125a-c740-434f-94bb-b5f35708575b", "comment": "Malware payload (DiamondFox)", "value": "fcfbfbbc2f17c2aed8d779042c5d9b19914b8400", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352958, "uuid": "7ade8af2-5f4a-4aca-8982-e1cc4ce0b882", "comment": "Malware payload (DiamondFox)", "value": "75f0b466467c61d475b1f3f6c0aeea3e26f22f73aef759a3b5bda4ef844babc8785bf218930373b89766a102becfc407", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352958, "uuid": "fabdff5a-a55a-4b06-b133-203ae66b6eed", "value": "T14D948C2837E0CC22C5AE067168A0D6718634ED2257728BD727C46FBB3D773C09965BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352958, "uuid": "65c9a4e3-a72a-4e6e-91f3-8aff47087c1a", "value": "6256ca6fb1d33cce27dff272311e3072", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352958, "uuid": "f15bfb6e-8034-4e35-850e-f8e3ebef2cd3", "value": "6144:D/Bcy+NMnMJQTffu0aVYv1pE0EAPMrGWsWDWidF0HQszCZ2Ftppb9Y81+k7pq7Fq:DR+qn9fu0aaS2zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352958, "uuid": "e337c436-4458-4ecb-b167-7362b45e9fff", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352958, "uuid": "b6d540f5-20d0-4729-8247-8db5eb55590c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352958, "uuid": "bcc25bac-7f93-48ec-a6ad-5507fddf83ce", "value": "AeXXqhQNJKur7teIlOrvF329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b83466-2e7f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634388603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388603, "uuid": "7258bcd2-ee57-4ba5-8c73-bf01755fe977", "comment": "Malware payload (Mirai)", "value": "b09733640bc3bf31caa497e2b2745bde", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388603, "uuid": "37e75a6b-77f8-494f-af05-f1222359893d", "comment": "Malware payload (Mirai)", "value": "77d577a9e5b5a5586e42f6dd6dbdd4ed5afa42c432c6393a981875e2e34eaea9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388603, "uuid": "97a5d1bb-4b36-40be-90e2-6ceb3d0dd0df", "comment": "Malware payload (Mirai)", "value": "a65cea483826d1c5fdce182ba6ca199f389c50e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388603, "uuid": "d22cc6c6-0d96-4905-ac88-263ecf71d7f2", "comment": "Malware payload (Mirai)", "value": "0bf8ee5a96395097c132906bc55e946f63f631cde4b58b8cbefb0a8ea790c8965a05d9911488c242e41dcbcdb0b4368e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388603, "uuid": "bd681b05-0a53-4288-8f8a-ebdaa8fe745a", "value": "T167B2E1C596FE2BC3C292D332E07C494DA2771AD10787850A1109B68E939760A9BFB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388603, "uuid": "cb4d7d73-31f7-4673-a703-db269989ae5a", "value": "768:w/QOC0Yhn6ROHWF09cwNPFCnNBxcoA9clch:w/nihneF1wKNBaTaOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634388603, "uuid": "8a723c95-6cf5-4e26-bc19-1168c2c1d323", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634388603, "uuid": "034b9d07-a342-43af-b280-b7647c5c9dca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388603, "uuid": "48b07cfa-372f-40f5-aaa3-6bf37dada1e8", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef0d256-2e74-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383761, "uuid": "89fa8ef2-2e63-42ec-9c4b-2786a2f3f084", "comment": "Malware payload (Gafgyt)", "value": "a09ea56a8dba8ccaf7b438be9b6ffbcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383761, "uuid": "d3854414-eded-49f4-8afa-6513cce3b3f6", "comment": "Malware payload (Gafgyt)", "value": "77d971bfd24566387fcc2be654d5e97ddbc8e48a6c04c8e9502e3940457e2b97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383761, "uuid": "b415d9bd-d7e5-451c-8d88-0c7e9a13f977", "comment": "Malware payload (Gafgyt)", "value": "85351338bd21c35a90315d388ba5940ad3685e9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383761, "uuid": "a2e583c9-67e1-4b08-8479-240c7a45674c", "comment": "Malware payload (Gafgyt)", "value": "7044d5aa3471db10449b64648c7f370b70db4f771ece3774e783bd95bbc21979341d4b764ced498e3a2924f2f17e2333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383761, "uuid": "966ad862-6ebe-47f4-b888-263738b124b3", "value": "T1F6B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383761, "uuid": "8b77153f-fd34-4c0c-ba2a-73d0ce429a7f", "value": "3072:b6an17WtsWhdgYJ50D6mbPbmTQOWsXAOn:Wan17WPJ50D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383761, "uuid": "4d8eceaf-0fb8-4182-9f09-4ae27a5571b6", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383761, "uuid": "7aef8659-2a55-4ccf-b9d2-708eb2172994", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383761, "uuid": "10166807-d0f0-4d72-a99a-a2d1128eaa31", "value": "a09ea56a8dba8ccaf7b438be9b6ffbcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d9f773-2ed2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634424228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424228, "uuid": "73b39248-5805-45ce-8ef3-42c971b78f8f", "comment": "Malware payload (RedLineStealer)", "value": "78b69e49f0a5f21fa0f32efc586127d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424228, "uuid": "49f20e2f-f2a1-49a5-9f4c-6be8c656ef47", "comment": "Malware payload (RedLineStealer)", "value": "77e2caf4331dde22109746028c48d4756e4044edfe826d9b2757d4851f7548e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424228, "uuid": "d9948abd-07d0-46b7-aa87-e95efeb38097", "comment": "Malware payload (RedLineStealer)", "value": "3a22126ccab6730d0969324ee38fd1ab6c5b338e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424228, "uuid": "d8ba15a8-94eb-4423-a6bb-78c21f1a3966", "comment": "Malware payload (RedLineStealer)", "value": "e1581a70ec8f4888f0dd6cd22e7d70fd34829f5c7e07a55f30a9a34e1ab766c96105101c714839b09bace08d845cd0c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424228, "uuid": "18c454af-2326-4189-b9b0-26139d459ecd", "value": "T159949D10B660D039F5F662F58DBA9378A52E7EE16B2450CB63D51AEE97346E0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424228, "uuid": "43861462-0cfb-495a-a496-e694eca9af59", "value": "578dc7dab5389346cbcc286cae0d11e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424228, "uuid": "d2d25940-c70c-46cc-ba92-f988fc242d22", "value": "12288:gCZ0MX85ATORjU7VVC69+ynxW4g71dw65HchSsmeg:gpn5vu7Vsty84Y5Hch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634424228, "uuid": "97b11fec-f182-4888-a494-23246f2a5e05", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634424228, "uuid": "2d7835b0-00dc-433c-8d29-021b2748179d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424228, "uuid": "4bbcef69-7750-40da-901d-8e214a68f7fb", "value": "78b69e49f0a5f21fa0f32efc586127d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0b6567-2e74-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383780, "uuid": "68ea13fe-9bb3-45d4-a6a6-4b731dbb7e5c", "comment": "Malware payload (Gafgyt)", "value": "7cdc3dcc1bbf5818708439ea8c7e1b6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383780, "uuid": "96913a74-5415-4a7c-aa38-7b1e8a81e081", "comment": "Malware payload (Gafgyt)", "value": "78e79c37ea82c8a02f74f5b69315902ab75fdf850dcc447b3fe00aa9db72f407", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383780, "uuid": "c5116833-2051-41f4-8fb6-96213ab4f59f", "comment": "Malware payload (Gafgyt)", "value": "e62604132910ebc209454d28680368812fc241f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383780, "uuid": "4918d3fe-80ac-47d2-afa0-a6d47df7b568", "comment": "Malware payload (Gafgyt)", "value": "600d318283762d2969bf900f7281471997755b6f643545254cb1a10e0a320fb7b7f8cd133f19245b44e4d7301f04ee72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383780, "uuid": "40a8ff5b-621d-4b44-a55f-48c67163ba35", "value": "T145733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383780, "uuid": "ef53c4e1-a2ee-4814-a9a7-0104bcaff987", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMQMmLI2VOCjXUfJRk:45omr0xKFn6J+OrMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383780, "uuid": "c4dfdb18-2cda-4c8e-a0c7-41643999864a", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383780, "uuid": "c3751f4d-b440-4372-a981-0067c3e7c2a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383780, "uuid": "c1f560ff-946b-4f33-87fb-68f3b3977fa9", "value": "7cdc3dcc1bbf5818708439ea8c7e1b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6817460a-2e25-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634349873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349873, "uuid": "99733414-b2a5-4202-98d5-16e7c6f2eece", "comment": "Malware payload (Mirai)", "value": "a2febddea619630ea1e0c01c5c615acf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349873, "uuid": "af325c00-4412-476b-b22a-738414b2a150", "comment": "Malware payload (Mirai)", "value": "798997222056b9be71e27a492a046fae83c8dbe4bf23b059863e1a99dbb86938", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349873, "uuid": "befbef34-dc38-418c-b9c5-ff2c70b788e8", "comment": "Malware payload (Mirai)", "value": "52ebb71e4fa81b82613746fa4127e98eaaaece1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349873, "uuid": "26b4494f-8dea-4b7b-9a60-61a71b051737", "comment": "Malware payload (Mirai)", "value": "995e92d9b950f8d018c4dccf1169467d81c95d25e3de930a00785e37803eb79ad83eb05d360dde9f332527adeb66d78a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349873, "uuid": "5e979ab7-c04e-4003-aafc-4d323ffe9dbd", "value": "T10F2329417318099BE4E25DF16A3F2BE197EECE4224F07145794FBA859A31E32444AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349873, "uuid": "7d6889e5-3325-4740-8edc-8d72ceecb3b3", "value": "768:86/qxSJjZtIb6WRMMz1ltvAyNODbyb4kPRmK/oAr8QXRho7J35kQ86dHzS:j/lZKLltvAyNODbw4MmQ873bHzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634349873, "uuid": "d7cd3362-6d30-4c3a-a50b-31076aca8e3f", "value": 46856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634349873, "uuid": "d94b25d4-e40e-416e-ad50-c4a3e37ebc81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349873, "uuid": "96d2ac75-5735-40e0-800d-7619e6610e03", "value": "a2febddea619630ea1e0c01c5c615acf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50ea943-2ed8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634426882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426882, "uuid": "d44a4eb1-cf4c-46d5-a730-904452e96f3a", "comment": "Malware payload (RedLineStealer)", "value": "fd7d8966e180f5100abeebc7e7d13257", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426882, "uuid": "1a54730a-141f-4342-a738-336464c193d3", "comment": "Malware payload (RedLineStealer)", "value": "79d067e08f24f34f5c108085965378777762869a4812a6e66e65bd4c7386114e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426882, "uuid": "788072a0-1ed7-485d-b2d6-b2e3746d86db", "comment": "Malware payload (RedLineStealer)", "value": "115449bfceefb5f98341025564468a6092f8c99c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634426882, "uuid": "5c348c91-a401-42c2-9623-8d680b83f001", "comment": "Malware payload (RedLineStealer)", "value": "de76aeca26fee2e5634991932337ab46cc143cdb2acdbf87aa7f4d6c6c7921e155d68e18010e2047d45879a727e351da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426882, "uuid": "21f61343-9727-4a87-9325-19d722b1e406", "value": "T1A0B43828A47FD019C0E3EEB52DDCA4BAD99A59E7640C70331074632B8B71B84DE4F57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426882, "uuid": "b372cbd0-cc43-4f38-b531-c2330f5a3102", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426882, "uuid": "70890736-a986-4ae1-8449-2e235c872a26", "value": "12288:fhhl0ED+iEavpbYC7dUu2xSDCiKPSSObS1:vlz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634426882, "uuid": "6f18ab19-a2ef-4bad-9df0-b01adf843e74", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634426882, "uuid": "ac6bd837-1a67-4dd3-bcc5-81281354bc36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634426882, "uuid": "fbcd0a64-fdac-4cf4-b13c-d340da080407", "value": "fd7d8966e180f5100abeebc7e7d13257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca261c2-2e8f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634395300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395300, "uuid": "4030e75b-ed8a-4c9c-9f7e-d1007e093851", "comment": "Malware payload (RaccoonStealer)", "value": "4f9a9b1b7da87ecd06db9996d7d4acfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395300, "uuid": "bc08d1a5-3b1a-4190-bb61-a4adee72e038", "comment": "Malware payload (RaccoonStealer)", "value": "79e74116d9b6641a89f62b78d9b51450612c33cb346d1c86521ce5a8313d24c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395300, "uuid": "22c577f2-ff94-4189-8ce8-25bb77de292b", "comment": "Malware payload (RaccoonStealer)", "value": "f813c4b15688d02a467155148c95b75e85aa449f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395300, "uuid": "6b6d29db-76be-46f7-acbe-e1d59b106bc5", "comment": "Malware payload (RaccoonStealer)", "value": "7c67d0160e2184f60b143e95d9d3777eb9ba156a3c4da9eabadb4c90468d4fcc65994b9ae7d728394d7b5a8545138e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395300, "uuid": "d7788050-6cd9-43b1-92e0-7ca09c3275a6", "value": "T1B74733113B9B4225C261FF3666D9EE146D77EC3CF467B4BA1F832A2DD4E04225109EE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395300, "uuid": "4fdf98bf-4489-4cdd-b97d-cd89b4a7a91e", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395300, "uuid": "3fbd3661-646f-4d52-93f1-d3468a1f7bc5", "value": "393216:3spvgNx6jckByvGeTE0xwtL32JZSlkjWRtuK9JlLir2DrdGPpViRzieLbrK:gvSxBxamXSlll9JZ+0rdyiRzdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634395300, "uuid": "b5e531a4-2272-41a6-a651-99be5519660c", "value": 25326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634395300, "uuid": "30ae9ab5-5ac2-4780-8854-9f094c4bcd0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395300, "uuid": "1904ea75-e7ac-471b-bd2a-119b6c02bb6a", "value": "AdGuard.v7.7.3715.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7ddf69-2e74-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383757, "uuid": "1ef424d3-b69c-4ba6-a5e3-e5cdef0cab4b", "comment": "Malware payload (Gafgyt)", "value": "eaccaa447f3309642c7fdf4bbfc2a153", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383757, "uuid": "4a83742f-90a8-4097-9ff4-6d0d1f241730", "comment": "Malware payload (Gafgyt)", "value": "7dd5b319a810440a547c157caa69f48c0babea19ab2de4af65abf363f10f4d18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383757, "uuid": "637853e7-b2a9-4c3d-b353-6d10abd041a2", "comment": "Malware payload (Gafgyt)", "value": "b7bc20e3939d88848747c6316f1ce58af8773e0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383757, "uuid": "51b4d783-1c6d-4a31-98fe-4957ec4b09a6", "comment": "Malware payload (Gafgyt)", "value": "73ca79b68b44374ee29144f2edc530189186b82ec32f2005d356c0a6533c34894d09f163d7d8e940c91ec9e29df4eca4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383757, "uuid": "8c7b363b-f92b-4f0e-8456-2c9c0a2ace5c", "value": "T1D2B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383757, "uuid": "bc6e8e27-c07e-431a-a78d-4f18380aabbd", "value": "3072:R/4tNF9U4vvTKw6J73x8UmkiSFxfKxbXe:BUNFK+T8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383757, "uuid": "95deecdf-097c-41be-9048-5e5a112b953d", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383757, "uuid": "7048cce6-8354-4d2e-a599-3f7e8ff52ae1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383757, "uuid": "7c45e8b0-be60-486e-9453-18024bd4f01f", "value": "eaccaa447f3309642c7fdf4bbfc2a153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e1da98-2e28-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350989, "uuid": "a1d9c125-e068-45a6-8908-44b34efc973b", "comment": "Malware payload (Gafgyt)", "value": "94e1f735bd764e02d7d46a73e9edef8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350989, "uuid": "8f0a891c-da85-484e-a7ad-20431d2f06ba", "comment": "Malware payload (Gafgyt)", "value": "7fb8e5cd83e7059e9a95acb0ab403124b52e4554dd320b95d43c907ca6eb46a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350989, "uuid": "3688432a-4c56-4215-a19b-ba0044c511d4", "comment": "Malware payload (Gafgyt)", "value": "0162373899a2578ca4684ad195d029d5da7c7aa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350989, "uuid": "092d900b-50ff-434b-84be-d1ab1b9ec229", "comment": "Malware payload (Gafgyt)", "value": "0b015c2d3a4ecd89a8a5482e772386b9bda80f485a40949cb91d62b01ba1caec6773e405cecbe678339afbd06d079d2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350989, "uuid": "2524627d-8f2e-426f-8599-2a7715761f30", "value": "T102D3732E7E12AFBEE2A8863107F75F70879521D23AA19381F16CD7185E7128D1C9F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350989, "uuid": "6acf1b23-dd83-498c-a587-8f803410e90c", "value": "3072:QtkoDLxB+oIWDLxB+oIt27D/xwKG9MtXuZFzr8sp8GIsXBUNvWEqKif8W8KjCJUK:lwy1kWmJUmkg4Fx1DDxbxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350989, "uuid": "22f70022-1811-4da5-b715-8c1fd59c53c5", "value": 130756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350989, "uuid": "5bbd9688-cc57-45a0-bc6e-d797acd10285", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350989, "uuid": "d243b95f-55b3-4a0b-b96f-d5db28436f7c", "value": "94e1f735bd764e02d7d46a73e9edef8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e63f7cd-2e2d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634353185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353185, "uuid": "0d3bffbc-e24c-4e61-bbce-4f7fcb186152", "comment": "Malware payload", "value": "9ec6ecf38cb040515dd99edc3e964c10", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353185, "uuid": "d2ccb8e6-a1aa-42d9-903c-e3d3ab8fb70b", "comment": "Malware payload", "value": "80db68b4b0216a5371497f59d688d88108efe0bbf3d3fea1b969cde9ce8d4168", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353185, "uuid": "2d99c3a8-e640-4122-963d-f2b7cd83c532", "comment": "Malware payload", "value": "96013003c9055983f9e9411613364d6c29169738", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353185, "uuid": "5817d6e0-38b7-4e7d-aa3a-d599a7369897", "comment": "Malware payload", "value": "aedb56229b3ec60c19b1529baa0f1a1828462364e1f5bd9b862eb281893d4c69b9820bf9b59ce47284ae00047ed0608d", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353185, "uuid": "644378ad-87f0-46a1-bf6f-5e1c89de58f2", "value": "T1FC63A477416651A6C5492330F4711F0B7ABCC6291A80B69CF04FF2AEDC1D69D9AF83B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353185, "uuid": "faae02a4-0d00-486a-b955-1667c389219a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353185, "uuid": "6125d6ae-9971-40eb-9693-3756a0cd47e2", "value": "1536:4j0pmn2hl/P7r+5WVUj8ljpHkxw3AXWh:A0A8P7r+5YUqFBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634353185, "uuid": "ce9dae76-e67d-4df7-90c3-5f2ce1e44d9d", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634353185, "uuid": "514fa18a-a12d-417f-8492-86ec9235bd4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353185, "uuid": "2a2a84cf-7a24-4e6b-a224-507bcf859e24", "value": "WinHoster.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095cdff8-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634396100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396100, "uuid": "74e98034-7df5-46a3-839d-e767f48d9eb7", "comment": "Malware payload (Mirai)", "value": "a03d7d9b9e5940d2a4833231a9d2eab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396100, "uuid": "52aa5cc9-5bcf-40b7-a702-8217b3b4692f", "comment": "Malware payload (Mirai)", "value": "82decb373e48ff5a65f760c1bd2379d38735bca90fff8b964948672dca984f67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396100, "uuid": "7f700a2e-a392-453d-9e7b-ba4d9328233c", "comment": "Malware payload (Mirai)", "value": "c88eb16d8e91469a64c0c467b9d4299fa42038d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396100, "uuid": "df04eb0c-d37d-4c43-a6cf-17ebae947c4e", "comment": "Malware payload (Mirai)", "value": "134c9c3343dfefb4405f69dc0f5fbc67563d3c86afb25fe43a183d1fff469e5bef2b6ca276704b8e06e861443011adc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396100, "uuid": "24eb22b0-9332-4b35-ad4a-31967849a165", "value": "T135535B21AD7A2E17C0E4A17B12F78310B2F5578F2AA8CB1E7C721E4DBF55940161B2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396100, "uuid": "bb848234-98b7-4b90-96db-b1f72cf19df5", "value": "768:dE7c318fq2o361yxmLbGyFdJEQjg/wFMO1lNlxanO+3H69nJNSGI:OW1+q2E61yxObzdJRguM6a73MnJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396100, "uuid": "36f8d093-36f9-445c-b920-9d86ff715f44", "value": 64436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396100, "uuid": "92cc59fa-1df5-4d40-9bc2-982fdbc077b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396100, "uuid": "f5be048a-3dc0-43bb-a487-ea948faa7cb7", "value": "a03d7d9b9e5940d2a4833231a9d2eab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5768017-2e24-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634349627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349627, "uuid": "e95decb4-d970-4355-91d7-d4632668cebf", "comment": "Malware payload", "value": "d19992427b37f915362eb526956176c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349627, "uuid": "f61bf575-3452-4880-a3fa-30e34ebb5520", "comment": "Malware payload", "value": "8451eb87e2a3a73db78dceca538ffe5bec614f1297171910c57bd93484f679b7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349627, "uuid": "d54d004f-0a62-4aea-b5c6-ca6a8d9ef8a0", "comment": "Malware payload", "value": "00c2b8f572afdcf91e3df56da532db18647667b9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349627, "uuid": "1812a50e-150f-455f-8f0a-a9569df813e2", "comment": "Malware payload", "value": "3711553fb92bf1efccca56cd17164d00d3c91a099d265918e083244c0f625bb4679f7a2223d0f0dbd4fc564cc6a0d2e7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349627, "uuid": "46de6289-d7b2-44f4-92a5-6e10885e3b80", "value": "T1AAA4236C16075F59A6DDA4ADAA05C86E01CDD6DE8344E54C58C633B7C02AB0ABF7F80F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349627, "uuid": "1bb6019d-e58c-4e85-8836-019427cce06d", "value": "12288:vPaGs+PXdI24vESbdrS4oA9vmr/YhUJ8+S08kknbfYRI:viG9XdkZxr9Vmr/2L+S08kknDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634349627, "uuid": "cbac3470-cd4a-47db-be75-b92c6b009962", "value": 449497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634349627, "uuid": "72515d26-aa6b-4b62-86c1-0bf8e37f10e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349627, "uuid": "793fc5f6-9d85-4b5e-abee-c97ae153d6ae", "value": "d19992427b37f915362eb526956176c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bade25-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634350490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350490, "uuid": "0e23219e-4770-46e2-9ffc-75043504f3be", "comment": "Malware payload (Mirai)", "value": "6998427f6ca2d2a6b28a40bfc268b05f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350490, "uuid": "0b4c6379-05b9-4b24-aaa6-92826a4292f0", "comment": "Malware payload (Mirai)", "value": "874ba5020c4326e572615c5eb65a056ba1d7c5f6cfb7f132213db533e0d0b6e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350490, "uuid": "3b6ff3be-b71f-493d-bed7-43fccdb49b2c", "comment": "Malware payload (Mirai)", "value": "9ec1c9b8cb205ba8fa0cceeda8143c5ff0810489", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350490, "uuid": "743ee597-39d7-417b-8785-0135fcccca6d", "comment": "Malware payload (Mirai)", "value": "2e9864fe2fa8a8e8ebdc664ff98c42ac442a6fe92079e67f633e7a50467b87e7a8aedf5a9c6b41c855748228cd90a3ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350490, "uuid": "5dac49db-4eff-4c26-b3a3-3db2fb13bc4c", "value": "T16A13D7C8EA0790F4DD070E30715BBE7F8634A921C979DDEADB89B905ED33612900A779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350490, "uuid": "47baad8a-4269-4a19-abf5-89fbb65bc63c", "value": "768:KeC8h8Pp6VKfo4q6zELiL31nF/6A4R4KS5Hev8ro9HfqnL9:KX8h8Pp6VeoBOL3ZwkAv8c9HfiL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350490, "uuid": "314138e6-1dd8-40c1-a54f-ee667554e189", "value": 41556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350490, "uuid": "a9035505-4fea-4102-a523-2d4b954a1b51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350490, "uuid": "e0c51e9f-e821-42b3-9272-b253a1e48dd6", "value": "6998427f6ca2d2a6b28a40bfc268b05f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a822bb8a-2e4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634367160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367160, "uuid": "63a5a134-76f4-422f-811b-c7a328ad15ab", "comment": "Malware payload (Mirai)", "value": "9856c5e1a8f137c3b6739801ec7b87f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367160, "uuid": "f2d3b95d-bfb6-4922-8dc8-c69008104cf4", "comment": "Malware payload (Mirai)", "value": "891586994abf890ca028b6b5b82d91da2467d08800d00302d37491b79277ffc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367160, "uuid": "fe2a6bed-0a8c-415b-99b6-6c54ca5db8aa", "comment": "Malware payload (Mirai)", "value": "359fb84d4b5e2c92387f79939af05003ff2104bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367160, "uuid": "62b8766c-0057-4c90-a368-9fe17fe7a84d", "comment": "Malware payload (Mirai)", "value": "1d30f635fd7b1555c1c08f6f1b4855bc305a124f9f34f082ba4054bc62a8aec41dc36b05f9dd2f0bfbd505a6802788ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367160, "uuid": "e7e264d2-7b31-422d-99a8-66bf41b5ccb3", "value": "T13BD2C0BD5B0002AADAED40F926A907E93DB58F24E4C3ED5B59C0B792CE804F539975C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367160, "uuid": "90ae89b7-85a1-4329-9555-78d183f39a6a", "value": "768:2yvYLznDEB2iC+sDqC6NtxsLLd9AtQnX2JgGlzDpbuR1J5:xYnnDEBI+smAd9AtQyVJu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634367160, "uuid": "51517210-fe9a-4cec-9ee0-b3bdaa24fa43", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634367160, "uuid": "66e3499b-6a46-4825-95a1-796e90f52462", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367160, "uuid": "c2ebb112-10e1-4f1c-b374-9e24a6d510db", "value": "9856c5e1a8f137c3b6739801ec7b87f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d2f07b-2e3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634359803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359803, "uuid": "3f58a9bf-1ca6-49ef-8b34-4831356122a9", "comment": "Malware payload (Mirai)", "value": "df12b96e6cc6ad40ecbb30fa97100a36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359803, "uuid": "39a8a656-5b0b-4bd7-b5dd-e0afa1fbed6a", "comment": "Malware payload (Mirai)", "value": "89e52c56db06c2205359f2bd4f0b6e4cfc3807e78079cc2a13ac575e5fb8e976", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359803, "uuid": "cec3de07-dbd8-4150-bd01-7abde397eb2a", "comment": "Malware payload (Mirai)", "value": "5698933814c895e34a3fdcca8c45825bba78e237", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359803, "uuid": "dce5cb41-542b-44fc-bacb-68df3efecf17", "comment": "Malware payload (Mirai)", "value": "e62442addbacf2f51ffe50df065a9e5a1e5f13e67ea90c8d24d1be20ca7052ea8b264c451e8e0e1addbdf0df3d547ac4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359803, "uuid": "51800f1b-06dc-4ec0-a145-216844c60575", "value": "T16B436CC0DA83D8F3DD22067534779F328E77E57F2166EAC2D399953BA94A400A1133AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359803, "uuid": "755c80b5-8da1-49c0-8680-fc95abf46a51", "value": "1536:XgjlE3BK7or6uSjyL2L0/SRkVwpmixjqi:XVBK7or6RyLHuQAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634359803, "uuid": "80e5cc42-d0f9-4b62-9ec0-8dfd59148a96", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634359803, "uuid": "5ee23c7c-a60f-46c3-9abf-5ab06b67fb6c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359803, "uuid": "a8399902-7101-4754-9a97-695940d8da4e", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb59001d-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380937, "uuid": "cd099d4a-f8dc-49b1-8231-2ad4c74a8cee", "comment": "Malware payload (Gafgyt)", "value": "c492d7357bc8bab699244ce174b58838", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380937, "uuid": "bb7b32ef-30c6-4d9e-ba8f-d7adc9e20864", "comment": "Malware payload (Gafgyt)", "value": "8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380937, "uuid": "1be34174-443b-4bdc-8f07-38aa367d5239", "comment": "Malware payload (Gafgyt)", "value": "00496864b8442c4c855b1b2fc251ae9007a2f479", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380937, "uuid": "e9c9d57f-adbe-4bc7-b1bd-6612624b2e89", "comment": "Malware payload (Gafgyt)", "value": "c3866c2a32b17bcc5380819c8050b28f4cca52f3301ad45cf2e7c3b19c5747b1c9afd18128f854d0e20e398eba3788fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380937, "uuid": "a468b488-03df-4b1b-aa5c-ae3e29f83758", "value": "T15FC3093B77130E63C0CA107111E30732AAB5DF9835B95797A9A07D6C6F3BA843816BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380937, "uuid": "d80249a9-0657-4ec9-9303-a7e05fbe29c6", "value": "1536:tNI8XMn1RanJN95l45tWjSttsqV7v/Pmmi4l5bUCOCntyNO:4nrgJNPl4GOoqBPmm/l5bULCntyNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380937, "uuid": "9e68d032-204f-4332-a284-e5096d904dd4", "value": 123575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380937, "uuid": "c2c5d5bd-d95e-4e61-8990-3177ecc54597", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380937, "uuid": "79e810f9-baa9-4d3e-ac2b-8344c963825c", "value": "c492d7357bc8bab699244ce174b58838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a8d8a3-2e4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634366893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366893, "uuid": "833141f4-b087-48d5-b7b8-da773591ce6a", "comment": "Malware payload (Mirai)", "value": "3a7bab324802ebde54a219909a847149", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366893, "uuid": "e1106949-367c-4170-b679-db62446a8c07", "comment": "Malware payload (Mirai)", "value": "8ab3e99624a314c6cde4132a98e35fdad780253a0b885e544755ae0eba50e917", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366893, "uuid": "a3dc5213-6bab-4419-b91c-046a83f703a3", "comment": "Malware payload (Mirai)", "value": "4d21f94ef9c116e6ba4e9d09de44a79a89938752", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634366893, "uuid": "2b04cd66-5d78-46c7-9d2f-61de34b2b7f8", "comment": "Malware payload (Mirai)", "value": "647bb20687ab48e1dee5a1fd84bd8d577076161b759ffa6658c20e1349b29e545a47b276cdb5a248730c938edff7832b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366893, "uuid": "e784863e-7fcc-4115-912e-8610bc3b3965", "value": "T1BC735B24A9792E27C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF2465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366893, "uuid": "21a212d2-adda-4a48-868e-675c8bd3c3bf", "value": "1536:SbHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNTKjfQFRo:omcjaq+Dcc5J+vNwjfoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634366893, "uuid": "51a4b0b1-6400-4524-ab5b-65c71d3e83fd", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634366893, "uuid": "3a99179a-d532-491c-943d-3c9c3f102e6c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634366893, "uuid": "89f3b8e5-7311-475b-be2b-35aa53821657", "value": "3a7bab324802ebde54a219909a847149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e15e842-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350179, "uuid": "0ff45b20-f036-485d-852a-942d66c6d24a", "comment": "Malware payload (Gafgyt)", "value": "852b3306e68b188ac2b93c0e7acb773e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350179, "uuid": "ba75b7b9-9787-43db-a2f2-dd7c96ca460a", "comment": "Malware payload (Gafgyt)", "value": "8afa2b0e1f9b0e7336d0393f70eb2587f4aafdbc4dff8044859dac49782ab339", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350179, "uuid": "d4c5d5a4-cc24-4871-bb2f-796724222274", "comment": "Malware payload (Gafgyt)", "value": "08599f0551838cb5bc16163782231bb15fff8b8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350179, "uuid": "47f60ea9-a793-461a-8f79-04bed584e9ba", "comment": "Malware payload (Gafgyt)", "value": "12458097b55c4cb99d33afa7a38c63e3cea4b8da0a0e2d72dd5af138dd9f73be15a5c8f785ee6df95bdcd981f27bc1fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350179, "uuid": "9914b49f-3e83-4ecd-a8e6-52db4a5e1002", "value": "T131D3841ABB619EB7D81ECE37059A8901118DE18A12E97F6FB2B4C52CE75BC4F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350179, "uuid": "ce1939ce-7772-4d5d-a5cc-1d9ce648b3f3", "value": "1536:XdbeTTaKeNHLgKMzZtkTP3qoVO38wbyWWjbYUmkg4Fx1Df7xbxs:Xd+KgBQO3PWnYUmkg4Fx1DDxbxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350179, "uuid": "ef48a510-0aec-4436-a2d8-4fb3cbab5ba9", "value": 130836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350179, "uuid": "cc909b01-766a-4e63-ab65-767730074022", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350179, "uuid": "4a234618-73a2-4493-88d6-efb05ab519a5", "value": "852b3306e68b188ac2b93c0e7acb773e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb6871e-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350149, "uuid": "eab87ebb-c097-460d-8b12-c5e71dbbda49", "comment": "Malware payload (Gafgyt)", "value": "45ec26842b0d46df51d807f934aa6a10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350149, "uuid": "f09d3b2b-0541-4e27-be56-c8ad3366cd50", "comment": "Malware payload (Gafgyt)", "value": "8b62a861d1d831e455acd47932352de4ff72eca578fde6c63c5cf978491e04e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350149, "uuid": "1b32878a-40fb-4228-84f1-620fe88c5ae6", "comment": "Malware payload (Gafgyt)", "value": "f3686d5d500464051d3abec7938de301f4d9e6ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350149, "uuid": "d41e1e31-a5ad-4843-90e4-97c3ee4a27e1", "comment": "Malware payload (Gafgyt)", "value": "9a7d94a822a929d76bf07334461f83f8aef80994583fb55a4d691e4b4e7bc59f3f77adfc0a496f3beb129bdbf602bb67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350149, "uuid": "ca7c0f4c-8e05-4f50-baf0-82eab95b3c79", "value": "T12C932B57E9A69FB7C086AAB125EB5D300713A8911B4F1B5971389BF0034F9CDB80EF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350149, "uuid": "54233eae-9add-406c-a554-25e79a002fc7", "value": "1536:2FoZy0U3KMTGUPKN+FD3vcHmtAkJCbhobIUm/FVqOEe8f2es:YR0U37qUSNIvcAJM6bFm/FVqOD8f2es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350149, "uuid": "6446c03b-8b3d-49f5-9fec-e23959a0ecd3", "value": 92935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350149, "uuid": "e8413f5f-fd83-40d9-9731-4c3f62c8eef2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350149, "uuid": "8af42116-4d99-41f8-8543-58d0d32f80de", "value": "45ec26842b0d46df51d807f934aa6a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b885d4-2e5a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634372601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372601, "uuid": "47bbe1dd-eaae-42b9-9229-6fdca3f97bf5", "comment": "Malware payload", "value": "cf087f5735c3cc3bafbd27830da57e14", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372601, "uuid": "0210f7bb-6671-4e34-9c7b-c89a6d3de3ed", "comment": "Malware payload", "value": "8b79c8ef55dff2339f146a95f2bf5928be3256b460d06fcdb175d9bd7d0b817c", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372601, "uuid": "ba6ef72f-d1fc-444b-aa0a-98b22ee1fe0f", "comment": "Malware payload", "value": "20ff396f936a9b963a3d94493b0e9dd3e1eea816", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372601, "uuid": "31f010ae-b640-4251-b53c-fd14682493bd", "comment": "Malware payload", "value": "6021573d32c61b2eecb9ae425e30949195a3683adfd2d483e91cf9256dcbcddb3bfed53614389ad788f37971756b9b33", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372601, "uuid": "b3f371a1-4710-4b90-a7b1-d2bab0484b81", "value": "T137B42370661B6112AA93168F379F932017FA459DC58E586B05EF78FD2A062333EF4C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372601, "uuid": "719267dd-7d58-48fb-b21e-ac749f030310", "value": "12288:4Ul8S20EqBESpe0TssYEZ2CED90PmExjbsBVH7OjR:DJ/EqBEke04gZ2vqm02Vb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634372601, "uuid": "d00973c8-f3fc-4891-89c4-bb358598db80", "value": 495807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634372601, "uuid": "04f0b648-100a-4e78-9119-94e378d0d244", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372601, "uuid": "6d68a273-912b-4ba2-bc7e-824481977fff", "value": "Packing list.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445904cb-2e8c-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1634394051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394051, "uuid": "8d6cadef-9db4-452c-a50c-245191f25df8", "comment": "Malware payload (njrat)", "value": "984ff6ee5d1b7a975d9f95937101dfbc", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394051, "uuid": "653f87dd-08b3-48d2-be41-5ebb78cf1b94", "comment": "Malware payload (njrat)", "value": "8b83cbd6a35bbf62bc865b1037db4f3a3b6a35d5be7f99f1db620cc8b7ca1437", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394051, "uuid": "a154b471-8c20-4dab-a4f6-d2e7cf8b0089", "comment": "Malware payload (njrat)", "value": "a7180061ccbf2add84fe873f15d09f9511740338", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394051, "uuid": "dce065d6-c441-4508-841c-47e447c5020c", "comment": "Malware payload (njrat)", "value": "73109b4653106a94005182bc207225e5d82ceb2cdaa1b678e95e27dd99baf0c62750c8b67de81b136c8907220ad83e41", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394051, "uuid": "f41a64ca-b0e6-424e-be0e-14196816670b", "value": "T1C2758F10EB1DF7CE899295B0256A483EAA534F0B7698CF4934ACC914EF1D72C4DF9523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394051, "uuid": "ae4e0910-6396-4153-8fd0-7f13ee6d1b98", "value": "384:k191X1Y1O1r1R181MP1D1F1610kLT1WPfYFuTyWfuZd:WZujZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394051, "uuid": "0ce60f12-263c-4f51-91a2-7fd295c89b9f", "value": 1614396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394051, "uuid": "ecf366b0-2686-4af4-905b-d7eed5466d76", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394051, "uuid": "3d2cb55d-7d22-40a8-bac7-0c832dee041c", "value": "RFQ-474552121.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1155d4a5-2e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634396113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396113, "uuid": "49e7a1d5-50e6-4670-b67c-52fd118b3949", "comment": "Malware payload (Mirai)", "value": "85e39cd1f3a2f5061f73cc60952cd4f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396113, "uuid": "f8ae9a0f-6d76-4021-871e-7523427cf84f", "comment": "Malware payload (Mirai)", "value": "8cf7be493460716613ea65b88240882850f11ed751f6da3eb198a8d47e3d14c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396113, "uuid": "08934927-8465-4c93-90bd-8143c31f2923", "comment": "Malware payload (Mirai)", "value": "6647a576bee48c9227b21e045185c0b1743f22ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634396113, "uuid": "33efb101-de7d-40c0-b35d-af0d0271c685", "comment": "Malware payload (Mirai)", "value": "0380e89b18ad12c6d9960e0658664ffd0584c3ebdb18f32e8fd9709fbb2fb2b652f60133f4a88636a1c0923668a64e71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396113, "uuid": "d1044d6d-186a-444b-8716-877300f8a30c", "value": "T190C2D03891435EE6FBFB7DD11C469BD12AD4CB6A39B5C2E82684BE0005075B6650ECCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396113, "uuid": "bd8d4dad-92f0-442e-8662-41f2de5dd5bf", "value": "768:RYluopKtukdc6CVCzgqNYTqhBJ4uVcqgw0RNWXp:IukKtuk6hk+qhBJ4u+qgw0bWXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634396113, "uuid": "61f41291-4fe3-4e37-96b7-ec52f4e7f885", "value": 27612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634396113, "uuid": "758b1266-633a-4086-9937-2932b9bedbf9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634396113, "uuid": "182635b6-2d4b-44f5-96d7-45ad594c632e", "value": "85e39cd1f3a2f5061f73cc60952cd4f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d77090-2e3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634360036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360036, "uuid": "96213b2f-3526-4cf9-a849-09d00308bccd", "comment": "Malware payload (Formbook)", "value": "4df25b1c20737e69fed5b6efa397653b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360036, "uuid": "8ec68446-5617-4f07-8c4e-76eaf62b69a0", "comment": "Malware payload (Formbook)", "value": "8d0f3056715cf96af14714339ef1bc6fef37da86983bd0ba175e098eb0c2be8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360036, "uuid": "7695e06f-688d-498f-a2a1-d43cb4895b42", "comment": "Malware payload (Formbook)", "value": "a6488e2bbdb996e960a53ac240db045f8ecaf0f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360036, "uuid": "251f70c6-37b5-4528-8f9b-0700378f6de5", "comment": "Malware payload (Formbook)", "value": "38f9c87308625410ac7228a5abeff9a19d69076202902f8bfecfb8ca0dad5cf5ea81422eca426acfdd0732b5d57d1010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360036, "uuid": "c06056d3-69c6-4403-82cc-03416bdec0fb", "value": "T1D915236423D4425CCDFE8A7448B2B4D0333A7E77BD61E72E0C89746E4F723434A9699A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360036, "uuid": "219524fd-4b5d-4316-b73e-f51efc81fe39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360036, "uuid": "823ddf7c-d64e-4054-9b47-a71498c034ea", "value": "12288:oTJSBYtqWZg3beTp27q0c5GU6bibANUlkXDWtSXyl3dDK7ur811ouyXrEqrM0i1A:2kB0qV3beTsqlGbDUlWMS43NLBrEpJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634360036, "uuid": "7574c956-0ce7-41c8-8f63-e9ef614add6f", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634360036, "uuid": "0f5b2ae2-07ba-4198-a802-1fb113547280", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360036, "uuid": "0224835c-7902-4075-83e0-525e47e0e4c3", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.22468.1615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664e107a-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392390, "uuid": "efca87a4-fc7b-4593-8728-bb035a164423", "comment": "Malware payload (Mirai)", "value": "e4fb6b978590ee80ee1383d7f05ffee9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392390, "uuid": "8737bb84-326c-4b7c-93b1-fdba02dda266", "comment": "Malware payload (Mirai)", "value": "8d680b87af1f053cf646eeeb6f79ce8b9225cc3dcb9171b81a3a5e441bc3a474", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392390, "uuid": "4cf90caf-c4fc-4250-982b-c20c7d8f60a4", "comment": "Malware payload (Mirai)", "value": "82835030bb8b06189c87629d258d5b0dbd49bb1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392390, "uuid": "dd71e391-f610-448e-8b06-23708c574173", "comment": "Malware payload (Mirai)", "value": "48ba7de3dde3e5fd8a1283ec52a2bc6ecdbf6a17239ec1ce59496efd439332ef794c6db5321b6fb8a423641fada5da99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392390, "uuid": "2d799bd1-d6ed-4dba-89f5-7808fa4aa729", "value": "T19AC2D160E4978892DAFB9AF10D947EC2B7BC8FD777F284891514BF112A148823319F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392390, "uuid": "b0e98154-2d0d-4a37-9ac8-8a1c7f1bac72", "value": "768:zOg+As/tEf0mKpHexzEa224uVcqgw0RNWXfn:9+XVc0F2zHL4u+qgw0bWXfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392390, "uuid": "b434e7bb-7aeb-4580-ae3d-e3c032e1ffc3", "value": 26884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392390, "uuid": "7fec3537-c249-4fc7-b1cf-5efff2319801", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392390, "uuid": "90e30b74-2bf5-437e-b94d-9d2d75407d34", "value": "e4fb6b978590ee80ee1383d7f05ffee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e548a72-2e6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634379922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379922, "uuid": "09cd36e4-0b51-404b-9839-7186f125fb6d", "comment": "Malware payload (Mirai)", "value": "8e0acf7cbc1569d0bd1c6c074278d367", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379922, "uuid": "a5946ecc-99e4-4e72-ab35-660815e405c6", "comment": "Malware payload (Mirai)", "value": "8de2cbab88b83f9bc0c84ce2d72837309b1024cd8df1196c7dcc0c5a9bf4ae6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379922, "uuid": "d4aae6fe-915f-4f20-80c7-3fa8531726ac", "comment": "Malware payload (Mirai)", "value": "d7d20eba1e8511501cf7e0f895011ac2242e6bc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379922, "uuid": "b71f2728-f438-4835-828b-e11d4866c2e5", "comment": "Malware payload (Mirai)", "value": "8a378b0251903b41c71431e145a257ebac9215bee0237a603a4721f91a1f483c176f197b7916d5d2916dc686b188a399", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379922, "uuid": "cb156d46-63d8-465b-92b0-294b4c3fb257", "value": "T1FE330841BC919912C9D42377FA2E11CE372263E8E1DF3207DE126F21778992F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379922, "uuid": "15b197a6-3964-47b5-b635-facbf808be45", "value": "768:gpA7EH1VkDFy8NX2wRratkX7YOvnsH04SbHQHUoOKEBNOm9RKvX0MI:37Y1aFy8NX2wRraCsknsPS7QHo9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379922, "uuid": "6b73a6c9-d40d-4066-a425-c98212b48b24", "value": 55044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379922, "uuid": "5517f21d-8d43-45ae-9a31-b0276185f9be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379922, "uuid": "df257225-73f0-4bf6-9359-410f06bfc34d", "value": "8e0acf7cbc1569d0bd1c6c074278d367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897cf1f8-2e3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634359808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359808, "uuid": "60a216e4-7295-4f3f-92a7-551f29382fd9", "comment": "Malware payload (Mirai)", "value": "76b5e1a723390876b9ebe6a416d1c8e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359808, "uuid": "c7c51fc8-1e44-4896-a3f1-dbc0039c5681", "comment": "Malware payload (Mirai)", "value": "8eaed5b15a7bfbffd79910fa7606609110892d126728719989ff13c1aeb106a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359808, "uuid": "c85f76f9-765d-41db-bd9b-34b76950cffc", "comment": "Malware payload (Mirai)", "value": "214b60372aa648b425475541c6336041448d72d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634359808, "uuid": "c22d426f-7d65-4a4d-8442-c98dcda44a4d", "comment": "Malware payload (Mirai)", "value": "aad22bf4f90c46cddcfd3c257604a787ac3ea96edce3d2fea871d0b7e96ef6cfe66612c37a0c680dc0f4cec1d2ce7dc0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359808, "uuid": "7eec1961-a31b-4064-bae9-2bc80f86fc22", "value": "T1C1632A55BC91CA26CAD022FBBB2E128D371553DCD1DF32039D296F746ACA91E0E37281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359808, "uuid": "94a1ce6f-08b2-4d68-84a5-81f2c3dcdc66", "value": "1536:iDfRRppc7nUZnF8gLja955wvsCIS0kYT/UEg9E5yMj8i:iD5moF8gLqI4DT/RoE5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634359808, "uuid": "15205648-0fcd-4cc9-8dbf-09e00c4a5284", "value": 67040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634359808, "uuid": "e04090a1-7b27-4f43-a2fc-59270a352604", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634359808, "uuid": "c016cf86-c90d-4b93-b752-5bfe248528f9", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f12c99f-2e71-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634382473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382473, "uuid": "668b9b58-8d81-4e3a-ab80-cb6c8ad844df", "comment": "Malware payload", "value": "076932ecc59c1ae3a465f4f7671e7f10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382473, "uuid": "8894cabe-d508-48ff-bd55-9703dde517c0", "comment": "Malware payload", "value": "8ec008691c49e4b2a6deba287d358876ce70a267b6b69cdf161b3b1aa11a74b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382473, "uuid": "f395de1d-1790-46b4-9449-65165039a691", "comment": "Malware payload", "value": "3ff7286d8eeaf03868229e438e99d200f9dee9de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634382473, "uuid": "8eb7fa99-8432-4d60-a377-1798d0520413", "comment": "Malware payload", "value": "2ab4fb92f3c908d1959634ff37811c02ca07e85b4dc2828cff14389474b84122b012161e6bbacaeae77208bcb278fbe5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634382473, "uuid": "9b9738b0-93ae-4b2e-b39b-96b8daa87048", "value": "T1EC13F13FA0C148E2DE7A887A29492335BB386BF12191CC17541822F14E916BE34F3F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634382473, "uuid": "30be7d11-056b-4a12-959b-b0671158fdd8", "value": "768:D76K35ngVhBhNUaDac0CrqMxSAT9UI2tFFElzrh0HIAX+8RyJgGlzDpxYsqIYgD5:D7ld87MaMs1SPSa2VrYeD1nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634382473, "uuid": "089f4ae9-7b23-44b5-bd7d-a0f3158bd1ed", "value": 45080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634382473, "uuid": "3c5d6686-e073-4a03-a390-6bb2539e1ac7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634382473, "uuid": "82e92366-e7ee-4921-ba01-0634ae5cf412", "value": "076932ecc59c1ae3a465f4f7671e7f10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d789093-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634376806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376806, "uuid": "69defe54-f57f-4c97-91fa-4b29038cf5b6", "comment": "Malware payload (BazaLoader)", "value": "3398fc38ef281ae2268478dd621445a2", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376806, "uuid": "80543532-5101-4969-b8e4-955d06d08017", "comment": "Malware payload (BazaLoader)", "value": "8f69a3a077e12b5e4ab5a446606f0fc226b827dcafb4f8e1768253b252dca895", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376806, "uuid": "0d9a3a2f-19bd-427c-b4a3-0d6405e88831", "comment": "Malware payload (BazaLoader)", "value": "40da9f5cbba17001805ef6ebd920f99743f044cc", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376806, "uuid": "edefe840-556e-4308-95f5-4f6fe34dd936", "comment": "Malware payload (BazaLoader)", "value": "d5b86f836449fb66e6922c843abae5fcdc7ef0d634cacfb7794ecff1366e012d488453240b398ee4d51486153eeda8b6", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376806, "uuid": "1ee84b2b-9682-4fcc-93f2-115a5d7be43c", "value": "T1D0E3BFF3487792AAEC309D778794F43F639EF8A3D7A7018017A85A76866F481CC76106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376806, "uuid": "a2ee1a3d-7521-42d4-a4f2-1d53090bbf9f", "value": "8734d13b604485dd72631733999be873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376806, "uuid": "e291c3bc-010c-454f-8d21-59083fa21ebc", "value": "3072:1SCAfk5O3REv4JksXfeyREnB41qRsPav6KDhcMePnwQ5c44IZUA7:3Ac5aeoK41Mqav6KOzP3cRA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376806, "uuid": "1709479c-c86a-4651-928e-b625cdd42ce8", "value": 156689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376806, "uuid": "8803dadf-40d8-44e9-862b-edcb1b5e7008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376806, "uuid": "97706484-f6e0-4ba8-975f-2d6655cd7ddc", "value": "WGEcMZQA.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b5f634-2e8e-11ec-843c-42010a9c0014", "comment": "Malware payload (StormKitty)", "timestamp": 1634395040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395040, "uuid": "4fee8c28-33c4-454b-9d77-6be78526a546", "comment": "Malware payload (StormKitty)", "value": "6a45ce654cdfa99ef7d43c1c555904e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395040, "uuid": "17c0cb17-b143-4386-95f2-b20fa413b93d", "comment": "Malware payload (StormKitty)", "value": "8fa1b5155ad0179816b99883ee1873f9f4b47539988a4c3e8ca00fd772ca6263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395040, "uuid": "b6a392a5-6aec-45fd-bf92-5bbfba2c2c47", "comment": "Malware payload (StormKitty)", "value": "63ea3c38291da602ba732b85ea2f87291cf41bd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395040, "uuid": "00061109-73ec-4c18-8df9-9cb3753f297a", "comment": "Malware payload (StormKitty)", "value": "c4ae98d9c7f5055b73f152e7790e3f448adca197a1969433162fa603d8df89aeb3feb2ecc8bd86c4c2005dbacf62e684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395040, "uuid": "2f782f6d-d8c5-42e8-915f-bac3fe938d55", "value": "T1B44633194141CCEFDCA5C37E22AB6BBD3654D8C82E97715E231EDDB69820683F0AD94C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395040, "uuid": "68080941-0e68-4c3c-b30e-7336c281a1e4", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395040, "uuid": "509b9636-7bfa-48a9-a9d5-96209a8122c5", "value": "98304:tbJ6oFhbg4j+WTPlq2vaG10/O4DWbfIekDYiPDMMz+NJbWVmeKT8NN119n:tb/jbg6N1vE/O4O1GnPD/CNihKTk11N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634395040, "uuid": "e3a26153-d0bf-4c31-adfd-7b516cc5e2b2", "value": 5751912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634395040, "uuid": "dd270cb6-ec93-4b70-b4b3-455b60e43ee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395040, "uuid": "545f3a58-2aa5-4667-9bdf-cafda8cc0c58", "value": "aInjector Win64_x32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698e414f-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634376934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376934, "uuid": "f93087ad-f38f-43fd-b3c3-feb813e66d40", "comment": "Malware payload (Gafgyt)", "value": "b64a1e2f514abde5311e703c66b7ee62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376934, "uuid": "28eff9a9-a89a-486a-a3d5-97517120cc1e", "comment": "Malware payload (Gafgyt)", "value": "8feee2db6053127c721ab4acc87e15fb53986086db0508144002a74da635ed6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376934, "uuid": "00f9c04b-e5de-4908-8090-3d425e7bbd7a", "comment": "Malware payload (Gafgyt)", "value": "cf6e491b50df3a6420dcbe57f072ad7edb68eb2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376934, "uuid": "f7f6b6e9-28f6-44f3-9cad-118d9b59465a", "comment": "Malware payload (Gafgyt)", "value": "568b00d8a32716ebf56243c6d3a2d7b76fdc3a3fbc3cc79d2d50b99f2200891f078aabaa0f50f427c7f7df3871d89827", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376934, "uuid": "4753bf58-dfe7-4f53-9570-65224835831b", "value": "T195D34C1BA6180753C05B89F12DB733E08BAAEFF205DA21C5E51EBE905B719752236FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376934, "uuid": "5f8917a9-ab85-4665-835d-85005e4454ab", "value": "3072:3XyCrorulW5MRzQetJ8add9QzhszOOKTZ6b7KQibhgBWI:3XyCroylkMRsetJ8addQm2TZ6b7KQibQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376934, "uuid": "2f3ec73a-6b91-4c6f-94b5-f2f82cb4b91c", "value": 137631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376934, "uuid": "e4c2e57c-dfbe-47a6-962e-6fad835b5ade", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376934, "uuid": "28f6b0ec-ea24-4e68-9147-372ac1d8c492", "value": "b64a1e2f514abde5311e703c66b7ee62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1caa85-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392370, "uuid": "40820858-9e6b-4c46-b779-0056b6699c42", "comment": "Malware payload (Mirai)", "value": "4a2132afa62eab6fc05b2c7e27fd4deb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392370, "uuid": "35ac2269-09d6-4180-a590-00f6f3ea31a1", "comment": "Malware payload (Mirai)", "value": "909e8ec54d5d450998d19990bf4bb78b21222845ab5e44b4e10049c31b670a10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392370, "uuid": "a374f516-3f2e-4ed0-a26a-b9a8a2bd4008", "comment": "Malware payload (Mirai)", "value": "e2ba77b879031cc73aa7b71069eb13944a44d91d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392370, "uuid": "1f4e3045-ac88-43f2-803c-d5b66d5108db", "comment": "Malware payload (Mirai)", "value": "1b5c8ad71c0f6ed892a5dbfc6d15514081d7baafaead49514bfcbf969d97dd1c3f29b95452a2139abab9554c85f344c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392370, "uuid": "cc380a21-4685-4ffd-8eb1-04215db3fda0", "value": "T1BBD2E029B12908E6D637E4F143AD7713A5B28FEBA8A3E5070485D1EB5A055EC3C53FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392370, "uuid": "de6159e5-1ad5-4ab6-80af-a1ab43cd7cd0", "value": "768:wvB94X1TovJoJ0E4zJ7Z+2UyRJgGlzDpUYsTY:wvBOBYEoZ+RyjVqYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392370, "uuid": "9d9092f0-f445-4ef0-8b4c-64dd37236c76", "value": 28960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392370, "uuid": "d018033c-b666-4aea-8542-f83811f25b01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392370, "uuid": "21149d31-d78f-40a1-8558-f2a70e0f292b", "value": "4a2132afa62eab6fc05b2c7e27fd4deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cdb27f-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1634394636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394636, "uuid": "d3f16302-3ce9-4793-a2c0-3b52f7496c10", "comment": "Malware payload (CoinMiner)", "value": "386382628bdab18db3b929a566756da5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394636, "uuid": "ce6788e6-ec89-4a80-8977-2913805dc556", "comment": "Malware payload (CoinMiner)", "value": "90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394636, "uuid": "9c2e1bb0-0428-4ec6-81d3-35709c9006d0", "comment": "Malware payload (CoinMiner)", "value": "fcd17baf5894cede249211bab735f97d8f6b5770", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394636, "uuid": "f3d980f2-b989-4cf9-872c-11780036a57e", "comment": "Malware payload (CoinMiner)", "value": "54a57c92a39f216312d53db94f7acbd4eb0b7b58ba8608f71e6068e1be42a4f49e707195945745115f1542c50046c81e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394636, "uuid": "f987e672-2486-42cd-b03d-8a64a85caee6", "value": "T130F63312A3E5C032FFA792739B99B20492B87D658063853F27581EAEBD702B1137D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394636, "uuid": "8a300f4d-346b-4755-b89d-f59509f5c2f0", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394636, "uuid": "8275b556-6cc2-4df5-a925-4338b946c91f", "value": "393216:gX+Ip+eLGEPexfSx3P/2ey6O/w/fDQnQj4cphWkBZU7A2:fIoEZPepShPOeldsQj4cphNBb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394636, "uuid": "384a37e9-50c7-4629-aaba-348c213b89ca", "value": 16723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394636, "uuid": "b21dd296-dd36-472d-baad-6e4e602554a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394636, "uuid": "89b6b354-679a-4831-8c96-10a355aa6d0c", "value": "386382628bdab18db3b929a566756da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a13409c-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380263, "uuid": "aa38b735-0269-406f-a739-d6741bb1ab71", "comment": "Malware payload (Gafgyt)", "value": "ae343e0b295a22d27b9654815db374a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380263, "uuid": "0d253c7d-a86c-4bad-b3f8-616fc1ce791a", "comment": "Malware payload (Gafgyt)", "value": "9191ca4480e5a960a3fe37805f0c22959ad64030472bb33f4e9ecca4520f6e6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380263, "uuid": "839e849d-1dda-4b20-8d7d-9784c9a02728", "comment": "Malware payload (Gafgyt)", "value": "ef0dbdddef3478254a7e10af8128f147c03e410e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380263, "uuid": "450e5124-8b2b-429c-b973-34fe8c7a7c80", "comment": "Malware payload (Gafgyt)", "value": "8b9500ee8f25b7548c785edf76ea03d052fd71284ce3f52d36066644d1d4788c0cc9c54a94f0d817a49bd71a7d1470b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380263, "uuid": "d119e446-beb8-49cf-be44-c6e451cecce5", "value": "T155933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380263, "uuid": "5642941a-6224-4004-b253-77353f7f288d", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8kl4umXxVqDrstKfz9e:Q97vk51RcG7Aul4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380263, "uuid": "9105173c-e26c-4b02-a7de-0446474a37c9", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380263, "uuid": "fba09204-3268-4acd-86ce-32272f28b0e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380263, "uuid": "593c2321-698f-4932-bc19-b14142362288", "value": "ae343e0b295a22d27b9654815db374a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc290ce-2eac-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634408029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408029, "uuid": "4b8271b2-5e63-4116-9523-941a081919d5", "comment": "Malware payload (Cerberus)", "value": "7e5caf6daf51ca0924bdc936a1de5943", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408029, "uuid": "acf96312-c335-4c2f-9292-a1ca4ee4b4d6", "comment": "Malware payload (Cerberus)", "value": "927720e4e2b6d946b3e228257c4e41c6e9e5ee147ab21ec3ebc94f0f15382828", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408029, "uuid": "1e0dcc9d-6fec-4e38-bb54-f9a2a9f9c6fc", "comment": "Malware payload (Cerberus)", "value": "ddb11dd2fe8f537526835648410a0d6a61288a61", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408029, "uuid": "5ca8f4a7-7a5b-42b9-a886-078666abfc52", "comment": "Malware payload (Cerberus)", "value": "908ad7692de3a2d2bcfffbe87e01cc616d0112e30a5f964289f73e15157788d18e752e97ef67ff18cc35250e974b8c7a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408029, "uuid": "18df0abd-27d5-4573-b577-581103fb3347", "value": "T1C23412CB0BA56115F023FAB611E837FF76BB071097D92ED2093C09588DA21792FD9A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408029, "uuid": "c9a0925c-efc6-4adb-91c3-43a4baf6aafd", "value": "6144:+9mUDLD8BQLAIhofbtp/35A7O14HFfWNORdVBAPp0HWNOR173BAZ1z:+5DXsQsIebF1csNORd8PZNORATz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634408029, "uuid": "3fece9ac-9140-408f-b7db-1f5fe6255911", "value": 247010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634408029, "uuid": "f8ee3bd6-ad08-4dc4-a0f7-fb216674f9de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408029, "uuid": "eec2e16a-9db1-40d1-b1ab-ccb84ef8a7ed", "value": "Android_Guncelleme_build_flow.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37965924-2e66-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634377709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377709, "uuid": "dcad99f5-4377-4254-82d0-219823ac5c23", "comment": "Malware payload", "value": "e6c7f2b2ab768cb512aa08f07330e793", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377709, "uuid": "23eb2f86-e3d7-4506-8cd5-04bf9e0b53bc", "comment": "Malware payload", "value": "92eb7cbeed440764ae87c26b9d38c9a9a0c57bdb9b344428f1d759744a1eb062", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377709, "uuid": "38cd2da0-3ead-4f15-852c-25739a008770", "comment": "Malware payload", "value": "31e61ef5e13bc1fd0e0b35a3e269762544e39053", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377709, "uuid": "6f7daaf0-efea-4f68-9eee-02a9606ea0a4", "comment": "Malware payload", "value": "3ff064daba23d2554da833a0b3203f3510e4196d5dda3af7cb8d82c5d1479c50ec0cfbadf7a0e3ddb524f73bb52aa6fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377709, "uuid": "4ada8029-0672-4a10-83d4-c4dbeabf00a4", "value": "T1F2936B10B5E1C471F17319352976DAE15A2EF9604F259EEB379C026E0F340D0AA3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377709, "uuid": "3dfaf6b1-d06b-443a-9ac5-939b67009246", "value": "b4f437d48e25c7b06031cb97b5e20cd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377709, "uuid": "1dcb2a78-78bd-46a6-a45e-c24b9beb511f", "value": "1536:r7MGinViupm7ir2Ooe+JciT1GdeYH2JaGdVtcrYxam5+s8jcdmhWfM3IP:r7XYZoBPTcYYH2cG6r4J78WU3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634377709, "uuid": "061f7cf7-b68a-4ab8-8230-880e18d733bd", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634377709, "uuid": "169fc56d-a181-4032-9114-36910bdf8485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377709, "uuid": "de881156-87da-4f0d-b89e-886ea51eb973", "value": "e6c7f2b2ab768cb512aa08f07330e793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad50cccf-2e61-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634375759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375759, "uuid": "74a53542-5c11-44ea-a7d0-a1481ba7d92b", "comment": "Malware payload (Mirai)", "value": "cfed8f640eecc4828979a6f4f0404b42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375759, "uuid": "e74b252d-8d0f-42b7-ae81-0620076a9867", "comment": "Malware payload (Mirai)", "value": "92f80d8065f10ddabc2676fc21049e8f2ac0c89f306621ce0c815e2ac122193e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375759, "uuid": "57cc1ca8-9292-4d9f-a6ae-75e9f74214d0", "comment": "Malware payload (Mirai)", "value": "ec2926677b978b5ec83539eb0cc89e3618d5921a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634375759, "uuid": "4794bc8e-bcbe-429e-859c-d334a60adf9d", "comment": "Malware payload (Mirai)", "value": "8297001eff40fb2d5a28c815729f8036d0d71e2afd7944bf1c1e6c81466b7ba7cb1c032c11ee7c03bd7abc260d9aeb40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634375759, "uuid": "a73d6dde-56b0-407d-be81-3b8b78ff7dc8", "value": "T1E8F3D82E3E11ABBEE164867107F75F60C3952AE726D19382E26CFA145F7028D185FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634375759, "uuid": "3c5d35f7-f657-41ac-975f-7d402ee0b7a8", "value": "3072:6ebGE4/9BRPeNRybjasY3Zx/0/48uJcs7RomeUQYlVgetJ8add9QzhsnRMe7jdfT:3buKhpbgetJ8addQGRMqjdfi+FqLwU+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634375759, "uuid": "04948d9d-3122-478f-8283-c3be4287eae1", "value": 170941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634375759, "uuid": "9bfa12df-b4da-4aa9-9212-3007f1a21ed0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634375759, "uuid": "94bb6865-f638-42fa-9a95-bba679d2fd2c", "value": "cfed8f640eecc4828979a6f4f0404b42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0aeb67-2e6a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634379654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379654, "uuid": "2c14256a-47d9-458b-b4f7-c9d618ec9979", "comment": "Malware payload", "value": "43ee61abb46efaa528bc55429c2bae0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379654, "uuid": "4723eb14-871c-4068-a0d0-53b87b937ee3", "comment": "Malware payload", "value": "93314cb154e1858af2c12d4d15ef2c055fd9efd883fd0902c35f6fef81b1b61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379654, "uuid": "f2579d5f-997a-4278-bb9d-bc27fd0b8b7d", "comment": "Malware payload", "value": "c3a5137014ca20515febe000c294531a24bcd2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379654, "uuid": "5fe77b40-f654-41de-a3c8-f35609135d9a", "comment": "Malware payload", "value": "82882d09865bb261f07ca142c08ee33da3e7f7dd99c2a1f86c579469148fe4d984b0a83dcc6870ec74e7b9a74bec3b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379654, "uuid": "7dedfa9f-55cf-41f3-ad5b-0d80a09eea68", "value": "T151F533D73E0AAC14D439C3B868F57A9C0B52CC46F6416E7DBF43259F549C8826AE22CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379654, "uuid": "77462e97-7d58-49f0-9f44-ec086d3c69ed", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379654, "uuid": "7fef04e9-c83d-41ca-b677-61eb31528cb1", "value": "49152:z3rM1Zdx5Z7Az0soNe41CBNrEDotnlsxCFy2fz2zrq+PCUdSE+v6yfgLMntp:C/7c0s2e4gbrEUdlYiSHBPCUd+BgLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379654, "uuid": "e3df4474-7880-4b53-b99e-beb448dad1a5", "value": 3498496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379654, "uuid": "86772322-017e-4334-a0a2-dde3ba2ca1a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379654, "uuid": "cabaf4cd-fa59-4dd2-a379-6293d511e94f", "value": "43ee61abb46efaa528bc55429c2bae0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c586f37-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634394628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394628, "uuid": "5ab6af7b-f7ac-42c3-9859-f166eb08b72c", "comment": "Malware payload (AveMariaRAT)", "value": "0acf7a0f0cea79d46c162eb227adb701", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394628, "uuid": "b6e90340-73c0-4213-a589-8d75f4139fc1", "comment": "Malware payload (AveMariaRAT)", "value": "9454554ff02715a0e17bde7743b9fa2eb0795058d02c178b148d2c090396dfba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394628, "uuid": "c20ca967-9a54-4905-966c-b738639a09ce", "comment": "Malware payload (AveMariaRAT)", "value": "c92b5dac7598717b3ee19fb50a2a96b48d69dfeb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394628, "uuid": "694d7139-15b6-4a1f-a3f6-c7dba811c63b", "comment": "Malware payload (AveMariaRAT)", "value": "50299d30c2b218caf5400f763878e0f973326ce380d14e7b62cf1f4618d0bc26d3a09925680b77968ba6f9967aa5bcbd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394628, "uuid": "46e7cbf4-b533-431b-a259-21fccdadc8a3", "value": "T10C92E42233D4C4D8E5D089354CD7AE700AF1BD229810B6AE37D07F2EAF33A82D655396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394628, "uuid": "ce991ef4-0797-4865-bd58-2d43bb71cc20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394628, "uuid": "dd087ecf-3a6b-4fc9-a773-f3cb36580ae4", "value": "384:0iWLce3/iToNFkr+yxKDQCkEKDVbJEp5KDGPGAblW/gFW:/J8urTl9mPG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394628, "uuid": "89063f1c-817a-4f44-aba1-03c6e4518d8d", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394628, "uuid": "b06cceef-47d6-40db-8f15-0a0ab9d67dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394628, "uuid": "0d715b21-7aeb-4501-b177-2a3da7c3e855", "value": "0acf7a0f0cea79d46c162eb227adb701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34269b9e-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634392306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392306, "uuid": "3c619473-fb4a-4faa-8e20-d17f18890818", "comment": "Malware payload (RedLineStealer)", "value": "016b358bed1f324213175237b8d7b6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392306, "uuid": "3bf883e6-7a95-4cfa-bc72-1051088fcb71", "comment": "Malware payload (RedLineStealer)", "value": "94d2b4ecaf220b47b6c90337b336c6f40943d0080493590067cac1c32cece6f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392306, "uuid": "db1d825e-1b59-48c3-9cd1-973f35ab893d", "comment": "Malware payload (RedLineStealer)", "value": "351e395d14be134e1ffd4e01556ce22c4087da9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392306, "uuid": "a77d2e1c-d0b8-43ae-abb3-2608a90f1f24", "comment": "Malware payload (RedLineStealer)", "value": "e32045aabb26e7ad68b26d0469a2909b4250878d76f2036a82bc97727dcbc0a4dac501e3ac116972cc94a039af051c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392306, "uuid": "5a75e498-54ac-4999-86ba-aa8bca49f190", "value": "T16546332FFE6537AED79129763284D4E9119DA320ACBBDBCF9B8D24C8B41D236044C54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392306, "uuid": "f84ca01d-b75b-42a0-92c3-37aa9b060a95", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392306, "uuid": "a90635cd-99d4-43dd-a8fa-f4a5324e9598", "value": "98304:Wmz5KY4JqbqsPQ7K1CtvTTQjBTld1lwlQbAW7o8ZT3R4:/AUs7K1CQldslKR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392306, "uuid": "d8ded327-4f0d-439f-ad5a-d29898e87611", "value": 5408207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392306, "uuid": "a0db8333-4b2f-4d5f-ab72-756d2a620330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392306, "uuid": "b026a705-adb2-4c25-8b99-7d5f4709fb52", "value": "VoiceModPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1088fd14-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634380650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380650, "uuid": "9cf38cf1-31da-427c-a92d-fe1208636042", "comment": "Malware payload (Mirai)", "value": "9c6cabf8e15be45e43747103e8d4f012", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380650, "uuid": "4e56cd36-b497-4f2e-921b-b454d61d130f", "comment": "Malware payload (Mirai)", "value": "95281f1bc4ae74e3837c8bfd02b06d0bd87a947ed62b5147bf4cc244d913a373", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380650, "uuid": "557baa22-26fb-4912-b797-b1e1278d3ae1", "comment": "Malware payload (Mirai)", "value": "d51923f6d6bb645e3b4aa8ddbb643a04121effdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380650, "uuid": "ec8117d2-7b85-4145-84ad-598327591693", "comment": "Malware payload (Mirai)", "value": "7d46ee919490cec04f988488c041f447f8a3d5b1518081db3e74aebe9fe093b263f6bbf08cd816005420c3d773977ae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380650, "uuid": "f81428b3-522d-4145-abee-affac25155d8", "value": "T138C34C46EB418A13C4D51775BADF424A3323E754E3DB33069918AFB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380650, "uuid": "12d90ff3-9233-4ead-97fb-85997036e9e6", "value": "3072:kZl5nBTdu40/9yTScClJTF54K+2oqM/9j4j:yl/Tdux1yTScClBF9+2hM/9Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380650, "uuid": "c92659a2-42cb-466b-861c-5d846268546c", "value": 127644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380650, "uuid": "314e2edd-f09e-4875-a71d-aaaf759261ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380650, "uuid": "19768d52-5db4-42a2-841f-2ea6953b7cfd", "value": "9c6cabf8e15be45e43747103e8d4f012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0429b214-2e2d-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1634353141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353141, "uuid": "f8db9729-19df-4bd6-8d77-ac3795b66826", "comment": "Malware payload (Socelars)", "value": "9da6fd3b6129076a2a7ffaa481ca5cf9", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353141, "uuid": "4baed1e7-7671-40a4-800b-b9b418f5b88e", "comment": "Malware payload (Socelars)", "value": "9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353141, "uuid": "fbebd0ea-cc96-49ed-a978-174fa639f0f1", "comment": "Malware payload (Socelars)", "value": "379bb58bee6bafad8169c47223e946e4bb9cfa0c", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353141, "uuid": "0f649245-dd6c-4097-ad23-33b68c02061b", "comment": "Malware payload (Socelars)", "value": "49d0601e756885c98aaf9e4e752cb43d5b29f5cf7660025b4e6bcc906e92c42490dc039dbb475eae7edbb60a358d77e6", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353141, "uuid": "2957af60-cfd8-4c59-9b25-aedc643c13fc", "value": "T11965AE11F742A036ECE301B386FF4AFF8D28A621034854D7E3C45DA95E619E27A3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353141, "uuid": "f528e141-8fec-4fcd-b00e-50766a8c1531", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353141, "uuid": "e2d29a9b-3c41-4f79-8bf7-d814d3b5e6cd", "value": "24576:+xpXPaR2J33o3S7P5zuHHOF2CxfehMHsGKzOYCMEMfX4vZ1fMKeC0:Opy+VDi8rgHfX4vZ9MKeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634353141, "uuid": "2a7e2b3c-8fa5-48d4-a9e2-f075efeea97e", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634353141, "uuid": "a02bf1c3-ea1a-484e-834c-8838c9ec9d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353141, "uuid": "ec538e3c-70cd-4fcf-a2f8-3b4d3eb2caeb", "value": "vZltlkxU4MPM2p1gCNefeyXw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd077ac-2e27-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634350980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350980, "uuid": "d5b2f5c9-57de-4f1c-9076-3af4868b9ddf", "comment": "Malware payload (Mirai)", "value": "9d630925f5bcb7c833742e379aceb3e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350980, "uuid": "bc7888ae-4e15-4980-a952-d23485617188", "comment": "Malware payload (Mirai)", "value": "99fbe24a08623347777ea275a369f5f05d773a8b6fc26c51d964c8c6f594d66a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350980, "uuid": "9312eed6-0d62-4539-86da-bcdeafed6c1d", "comment": "Malware payload (Mirai)", "value": "75896d75ed3068e9cedf9bbfb4738054cad50e03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350980, "uuid": "d359fd0c-cb41-498d-b3d5-1b8a3f9a5b26", "comment": "Malware payload (Mirai)", "value": "93c9bc4ac1fa95db6721c8b72f55b3458e411beeb7e6ac5d6a0165fabe1be1ea13e1629903c36cdc8e4a6fc0a7cdbfec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350980, "uuid": "4fb6831c-a12b-4115-9450-7ce5a380d8e0", "value": "T1F6434BC7F404D9BEF849D73B4C034D0D7271F1A14A531A725BA7BAABEE36148191EE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350980, "uuid": "f7e03698-f861-4c62-9d76-7c924dcbc5a9", "value": "1536:SzRZlfD88SZ9FQeuacWjcW0JcWcBsyy6oniBo7N7eA6vS58I3m:Sz/lfD2FQeuacWjcW0JcWcBry6oniBo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350980, "uuid": "bd364686-281e-4f80-8227-117a63697c37", "value": 58344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350980, "uuid": "ad76621a-af27-45be-aa00-2104a87b6204", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350980, "uuid": "7f17614e-bc1f-4a02-9b0d-01e4049cafae", "value": "9d630925f5bcb7c833742e379aceb3e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6703fc6b-2e6b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634379936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379936, "uuid": "2a35be92-6489-405d-8aba-2216716bc702", "comment": "Malware payload", "value": "7306387d0a39493ab1c3b687c50e3848", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379936, "uuid": "e018bebe-3386-4b9e-9247-d0932701fa42", "comment": "Malware payload", "value": "9a15be7c12fa6ae4a380bada990ab3024d55ec0c1e9fcf6935f18969a085ea6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379936, "uuid": "9324a3f7-9e22-47d0-a237-6607ffac5c49", "comment": "Malware payload", "value": "767b4a0284f71943d3ad1d0068f89e3989da3c72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379936, "uuid": "c9b9f226-eade-460a-816d-15cd1f36d2af", "comment": "Malware payload", "value": "d4a301890c3c091f92385d976ff4592149ada12e70a7d0da20476c9683345c343d0e1386e42ad10c54a02a669a8e0fe9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379936, "uuid": "73fe1f66-3707-4b39-853b-eef0e9a23323", "value": "T16613E0D4C7A7B4F1CDE05EF1E9D613C5B30B4DB8989B230067506BB1A9A5206A8BA053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379936, "uuid": "347b3745-2b4e-4a80-b9c2-fb77ce905d6b", "value": "768:GNZ5WLK7NP9dlQ3GaLhQRy0NFv4wCPWBrYdLXavvTkpLxpC3UPIqW9coG3Ma:0HWe7FlstQRGPWRquvvTkpLTIqWiJ33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379936, "uuid": "e4c5ef0b-c2e2-40c4-af29-ba9510d92247", "value": 44468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379936, "uuid": "d4661efe-a492-4e68-967a-a3c30475f5a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379936, "uuid": "69cc7b89-7c95-43c2-adb6-936021f733ae", "value": "7306387d0a39493ab1c3b687c50e3848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453411d3-2ecc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634421541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634421541, "uuid": "8129f0d1-8b0f-4dd2-83d0-8d6a082c0249", "comment": "Malware payload", "value": "5fc5f085acfa0071db7d7ecaca696650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634421541, "uuid": "d09bf991-2287-42d1-912e-388e015449f8", "comment": "Malware payload", "value": "9d35a2153846ecea71060d69014279cb526f8b432913d02759c5023a81c62d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634421541, "uuid": "d80a7c4e-5795-4842-befc-b5d821c365b4", "comment": "Malware payload", "value": "a756cd5b994f5afe33a4692352bae57a9f5313a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634421541, "uuid": "82bb3aa9-08a6-47fa-9425-f21e7f57b9e7", "comment": "Malware payload", "value": "f0d5b1fe8f93e68904741f43e74e3a9d913101f9047995304ee40c0bddedf103915bb0c83f71dc7775d0cc49112e5e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634421541, "uuid": "58103e08-c48f-45b3-8bbf-34ee2e765b2a", "value": "T175657D4AA3A901ECD0ABD278CA52960BE7B1780103309BDF17D55B5A1F23FE15E7E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634421541, "uuid": "12d5d199-d7ee-4a05-a8cc-bd3cbcfa5c96", "value": "a760781485268ad462242975d68411d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634421541, "uuid": "06c152e3-d693-4cf5-8b8f-e65392d5b2d1", "value": "24576:nkg6rJg7+sAKWHUUuxRfAmBJOQEhP4v4qLq/nbFtU+a1Svk7t:nulgSsAtHUdTzOQoP0Lq/xh9vkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634421541, "uuid": "34997b2b-f65d-42ea-98ab-93755d409129", "value": 1413120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634421541, "uuid": "cd89e938-5628-402d-b0e2-e73dbe401e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634421541, "uuid": "c1d3a98e-1af2-4c2f-820b-07b04b6842de", "value": "5fc5f085acfa0071db7d7ecaca696650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8f7115-2ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634403007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403007, "uuid": "7b6909f5-d9b6-4fb5-8470-3d2b7a9262fc", "comment": "Malware payload (Mirai)", "value": "6ffa7a80e66bf1ac61552cb795f65e09", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403007, "uuid": "0f0a73f4-11c9-47da-895c-2ebc27282c3e", "comment": "Malware payload (Mirai)", "value": "9e3e4b4d14feae3e13ce762ee6a0b899f15908d05950d872de5492ab5cb029d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403007, "uuid": "ce5b019f-2866-4190-8c09-3c40d575c67f", "comment": "Malware payload (Mirai)", "value": "e8f395cc2b51ea8db7cde478c1bd7f6a18ac1736", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403007, "uuid": "50bce1a8-a89f-471f-b650-b94c09c64dcc", "comment": "Malware payload (Mirai)", "value": "e3bdac5d2f07fd4b82f28ac6e09e4db1688cc091937006635b50ac35f4aaaf67667e7eff4662bf4a1ce3802501b7a42b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403007, "uuid": "36867a4e-c83e-4b46-bf67-4b51b0c7d3fc", "value": "T19253E9627C926A2AC5E063BAF6BE518D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403007, "uuid": "cfe46d77-d794-4a11-940c-38a1216e55e6", "value": "1536:omHfUXVywKHMIeVOeKSs2KlkaLFgiZu6Kjoh+tTnS:omHfUl1IFM6KEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634403007, "uuid": "836ef6c2-66ac-4797-b022-ce96d1e24e19", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634403007, "uuid": "41d435c6-50ac-4d96-91d0-1e0c67aad85e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403007, "uuid": "85969a62-c82f-4e77-87f1-662d5db428cb", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9470743-2eac-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634408045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408045, "uuid": "5781ddb0-337c-440e-9dfc-fcec8c6923f2", "comment": "Malware payload (Cerberus)", "value": "62f5db5df34e50de3092e3e15b64de99", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408045, "uuid": "ae9b6a22-c572-4b26-96a4-d0b9cb9007c0", "comment": "Malware payload (Cerberus)", "value": "a09e1cf2e6514a984917f749815861f8dc3730164fa5ba92c50628ff948d38d9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408045, "uuid": "00042fcb-7e8d-4485-8056-c09083bf3f29", "comment": "Malware payload (Cerberus)", "value": "a7bd3e84616fc6017b8085b777106e1932330a4a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634408045, "uuid": "8ba5a7c6-6675-4848-952b-ed4da96b8764", "comment": "Malware payload (Cerberus)", "value": "b2e3ad55e787845611e7a83caa17f66af06440f3a637f738caf222ac344c5b5facaebf6c6649fc05325a46766fa70afd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408045, "uuid": "141a157f-94c3-4c40-8cab-ebecb3426a62", "value": "T17FD533890E218CD3E5EFD0709943920331116F718716EB1F764979A0A8FBF9A950BE7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408045, "uuid": "d71b2f5a-d5f6-4468-ab11-af7ca3bc54c8", "value": "49152:nsnlPzsXAl9zw0Uj5uibGCtinsq3gZYiCjHhyS+RTgie+N47ZET+L57tNjQ6kkdU:slPz0Al9zwb5ui/qwZYiMApf67tVhN8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634408045, "uuid": "0f646529-40c5-4866-86d3-c63d2aa87f1b", "value": 2996100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634408045, "uuid": "07f29b6b-6de3-4328-a1b0-0c409b64542a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634408045, "uuid": "05dbf1f0-7540-499f-87b2-2ae175690e1a", "value": "ALEYNA_TILKI_IFSA_build_obf_4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec04b4b-2e65-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634377318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377318, "uuid": "270b92ae-3e40-489b-803e-f8de5938f520", "comment": "Malware payload (Mirai)", "value": "f30f6a629c2f8068eb04786bf15c1430", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377318, "uuid": "06fb15ec-dccf-4358-8811-f93877baf464", "comment": "Malware payload (Mirai)", "value": "a2751613e7d3b31276fd32d3774fe2b035c8644361689ed1b7c5269fe91192e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377318, "uuid": "7cb27b6f-afdc-4c72-9bd8-e14a6a164634", "comment": "Malware payload (Mirai)", "value": "75ff13a58bee768c16d296b7e27857680ff08a1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377318, "uuid": "5b6729a1-53ba-4007-8d1d-3109ad5f8fe9", "comment": "Malware payload (Mirai)", "value": "ab9baec1e9c1787ce2df935aadb5173e998fd1dd33ccd9bd65aa141050a5ffb34d65164ff01beaf05a05753940a917ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377318, "uuid": "8db801eb-7b21-4d1f-9537-32d80bcdc3c0", "value": "T184D31A06F8004663C2D16BB7B35B438D77225FA957DB3342EA297DB02FE1B491A399D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377318, "uuid": "afc7fefa-bcc6-4f33-85c8-f835fb3b9730", "value": "3072:f/R2c/5sY31bA7PZ/U9pCVHV9zietJ8add9Qzhsdkn5KDKPX4ctQ6W8GoQTXI:0RU9pCBnzietJ8addQckn1X4ctQ6Wvo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634377318, "uuid": "1a09da9e-68c8-4282-ad64-93e238da820b", "value": 142221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634377318, "uuid": "724addec-c73e-4912-983e-e2be60f3fc64", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377318, "uuid": "4cdafbea-6eb5-4a46-b8e8-74f22035ea30", "value": "f30f6a629c2f8068eb04786bf15c1430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac3fe7d-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393149, "uuid": "cddad4c6-da97-48bd-9d70-bb44555070d8", "comment": "Malware payload (Mirai)", "value": "fc37ae1e7355f76868f40e8bfb3b17c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393149, "uuid": "80f9c76a-c257-45be-bc24-18543a832f4c", "comment": "Malware payload (Mirai)", "value": "a2e0c26bf97e4e462437d96972f6f954dad118c2911216b22d26f450774e435d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393149, "uuid": "96aab6fc-232a-4b27-92dd-6f7f0f31c5eb", "comment": "Malware payload (Mirai)", "value": "3fffca03c3742b0323b59ca947befc88d22e1398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393149, "uuid": "61b9b047-8dd2-41a2-a1bc-fd262668141f", "comment": "Malware payload (Mirai)", "value": "29ed51293dc258365454908928a7434dc3c74a45d2028749db4db1770ddd20ffa2c3d3c141744b2fe2db9337112fbb72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393149, "uuid": "cb0ab9f5-a965-437e-a80e-cbd332c99a10", "value": "T13E230996BCE28A59C9C42377FA2E419D3312A3ECC2EF3717CD141B1176C651E4E62A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393149, "uuid": "91248c00-40ad-4026-838a-0fba3441aa1a", "value": "768:XLBRG0CCxDSTeNhKsCn1/ieQYRPxTiQoBOPYNr7TxOHyw6EN91MCdBNVF1:1RzUeesCEex1iQoB+kJOV9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393149, "uuid": "9f41f00c-5eb4-4db1-a238-525bf4b2db6e", "value": 46460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393149, "uuid": "4832fdba-9981-43b2-be5a-668bf59ad120", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393149, "uuid": "869fe85b-0080-4e90-b7a7-49055c5d1d3b", "value": "fc37ae1e7355f76868f40e8bfb3b17c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53568ba7-2eb7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634412545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412545, "uuid": "5ce8c904-56e8-4d8d-a293-4ce2dbe31a20", "comment": "Malware payload", "value": "93b27733d5e46b676eca9cf990652070", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412545, "uuid": "fe95c453-e8fb-4bf7-8d65-7d631a350f73", "comment": "Malware payload", "value": "a799700b7e69cf25a7a59b29a10152e1f6daac91c00da3b54b655b69dd5f07be", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412545, "uuid": "8b81dbd6-3dee-43f5-b9a5-a3953cdece60", "comment": "Malware payload", "value": "0a05295c92ca61e2d8c0d5cd9479aed975fb2f52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634412545, "uuid": "49fc7393-3b91-465d-a41b-337588ca626c", "comment": "Malware payload", "value": "cb1ab6e41cdcdcfd4fbc441218ce5dbc37f90dfb935918efb035902620d042cf05529e41226cb19fe305ddcde3d91dae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634412545, "uuid": "aa9a74c7-38f7-4078-9297-3a60847dc11a", "value": "T1CB6313F961896CE9D9A4545CFCB5404A6E6C5F47B71CC184E2ECD0893C3C0FAA32AF69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634412545, "uuid": "14ef0d45-adf3-4dac-b426-b7d47f00d94f", "value": "1536:xEBprfWyvKwuY7FuG3ysXlpkXYFjW1gTc5iJoyGpM/cwua2:xEBprfWyvKwd7FPysXlpkXYFjW1gTEyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634412545, "uuid": "c9889e9a-1827-47c1-8b6a-4fc473a61856", "value": 67930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634412545, "uuid": "526bdf21-9201-464e-aa58-880b444d09ba", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634412545, "uuid": "edfe0bc6-1760-4c2e-8a89-7ce59b0512fd", "value": "questioneer-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b3e8f6-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634376956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376956, "uuid": "6f04921d-6fef-4c07-be7a-46c33891fdc1", "comment": "Malware payload (Gafgyt)", "value": "19aad53fcbaee59f8aeb39e2e92ebe99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376956, "uuid": "f02dc497-f43f-4f0b-b8c1-c9a86b9d6843", "comment": "Malware payload (Gafgyt)", "value": "a8387f3b234d20e2e71f4b55ad7f51143e2c277963b48aca66975a3d729aad21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376956, "uuid": "9351166c-20d2-48b9-9484-6837a6041d5b", "comment": "Malware payload (Gafgyt)", "value": "910f4bc1e6ad26c19eb97e7ff4dd015f09fd712f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376956, "uuid": "2390dbfd-ad02-416c-bffb-75813181a043", "comment": "Malware payload (Gafgyt)", "value": "0aeec297c3560e83e4f349bdbdbb592470aeb58fee2a81819728c907d0d377c863c48006b8e644929aeb50568de24127", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376956, "uuid": "16994796-5ff8-45fd-9312-7d7f7b4a36bf", "value": "T1CBC3291798118AB2C0059D7121B726204B53BEB74A8F16D6E92DBAF05B778CF712EFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376956, "uuid": "dac7504a-4b44-4c68-b9d5-9676812fd619", "value": "3072:FiabsdSvvr98JUuUtMetJ8add9QzhsJLG9RFyeKQ5CGBgB3Y:FiDSvZ7uUtMetJ8addQEWFyeKQ5BBgBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376956, "uuid": "958a929a-5821-4998-9428-dca6cc363cc4", "value": 129728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376956, "uuid": "158f4f39-4109-49ba-bb07-e69628a35609", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376956, "uuid": "90d9de63-6d4f-42d1-a338-babb3a436f01", "value": "19aad53fcbaee59f8aeb39e2e92ebe99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e82ce1-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634394609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394609, "uuid": "e03bd2a6-4974-4bfe-9eec-0f266b250341", "comment": "Malware payload (Mirai)", "value": "579d15154d9ae8747da9c054f675753b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394609, "uuid": "e4b2d0e0-c410-4c07-91dd-6a974d486ca6", "comment": "Malware payload (Mirai)", "value": "a85658f8e368cf16add477d0455be0c217a19d61759316566f469e46dad54179", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394609, "uuid": "8b0b6ba4-b6f6-4655-b0e0-3381e372017f", "comment": "Malware payload (Mirai)", "value": "e46cf6558051302410abd821e18486979ae41630", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394609, "uuid": "8b7652d2-8157-4b44-a801-2649219c52c6", "comment": "Malware payload (Mirai)", "value": "c8822ee43463648c6a0a0b951b1163bf7871517c2658cb4f22f95d1a8932b47d8d0b16d22f90bcd1a67e48fff3081885", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394609, "uuid": "57dbf671-83a8-40f0-ab2f-86c558e3e3cd", "value": "T1875328D6B800AE3CFC6FEA7A84164A0DF921725145530F37A37BFC93AC320A45967E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394609, "uuid": "780058d2-8b15-4776-baa6-8761b1da5823", "value": "1536:/gX1FpLNtCjIzVnHZudRg7GktYshy8vCOq84:/gHKsRZKRWH+qvvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394609, "uuid": "7a766a91-5d3c-4c70-9791-f6af189f1f70", "value": 62500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394609, "uuid": "2bb7f030-0b6d-492a-af02-4f4025ac0b95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394609, "uuid": "1d4d3267-2207-4164-812d-b76a451258ad", "value": "579d15154d9ae8747da9c054f675753b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263af003-2e5a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634372526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372526, "uuid": "a3a788fe-da7e-4751-a7fa-f10924df2dda", "comment": "Malware payload", "value": "1ed87c94967649f5b8db75a6e5531518", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372526, "uuid": "c57a2545-e992-4f4a-a797-e04c74b574a7", "comment": "Malware payload", "value": "aae88fda4d3d711c4e9c250be5a5f92b8b7f048f509588bc9195943b75c17f79", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372526, "uuid": "e997e9d2-fd65-494a-8223-1d4131cfd4cd", "comment": "Malware payload", "value": "f49ee36b1bb98f18e0cf2d3e889990c1825e1057", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372526, "uuid": "96cbb591-f9e0-4a15-a7c2-aaf65984143a", "comment": "Malware payload", "value": "dcb3da9bd9415094138e2af9d5dbfd1c0f3d3a22fa7c5c0c81bd89fee77b8b32aacd8ca1de7510f4b1c40091554d9afe", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372526, "uuid": "58bea261-1912-4939-a979-5d7e39621504", "value": "T1D7B42370661B6112AA93168F379F932017FA459DC58E596B05EF78FC2A062333EF4C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372526, "uuid": "a3a47c1e-d55f-4388-b90b-1f6c8943ef2d", "value": "12288:KUl8S20EqBESpe0TssYEZ2CED90PmExjbsBVH7Oj5:dJ/EqBEke04gZ2vqm02Vb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634372526, "uuid": "085716ea-e4be-42d6-bc55-336ff442f979", "value": 495815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634372526, "uuid": "143b77bf-65c9-460f-8a6c-57d68df84689", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372526, "uuid": "84c318b1-f22a-4447-9950-1ba0d6d21e02", "value": "Bill of Lading.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34087a3a-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380280, "uuid": "952e4c33-b39e-461d-9e40-f83977c7b625", "comment": "Malware payload (Gafgyt)", "value": "9ec0f1659a67eb751c981860e31903db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380280, "uuid": "aa6f65f3-1b5e-476d-9a18-14a81f0357c8", "comment": "Malware payload (Gafgyt)", "value": "ad0c93d57e36644098fcf220fef0098a640e113578ab19fab7a9883b8c113295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380280, "uuid": "1c1f96dc-020c-449e-a680-a9ac4b188adc", "comment": "Malware payload (Gafgyt)", "value": "2fb21f1a8bf20f2a5bcb7eb07926658c75b21b05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380280, "uuid": "708221a5-d565-4968-b24a-75b3f22a01a5", "comment": "Malware payload (Gafgyt)", "value": "57df455ba19e566d60125f700b698c8f0db9ab98eff0fb9a0d370a43d42fb777683d574e540779c535ca2e8ff65be488", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380280, "uuid": "6313ff2b-b103-4b86-8272-cf9fcd9617e3", "value": "T13FC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380280, "uuid": "8259d65f-291c-41ca-85d2-110a32139e90", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBexEdWfRZrmW+IFj:Ted0W0MZQHZd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380280, "uuid": "d25d619d-bf77-4ded-9c78-edeb16d1be22", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380280, "uuid": "b464b9c0-72ef-4b26-b04f-87a6b62c1e57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380280, "uuid": "efb9ff38-deb9-4e5c-93a0-d558587861e2", "value": "9ec0f1659a67eb751c981860e31903db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ebe75c-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634350168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350168, "uuid": "2fc5bda7-2014-4c0a-abe2-669bcb4ed812", "comment": "Malware payload (Mirai)", "value": "f15682da870e7e206550d1b7c5c29882", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350168, "uuid": "dc8bf7ab-e8c4-4663-b326-a4ac2e11fae3", "comment": "Malware payload (Mirai)", "value": "ad33d8ebab711b6a72312fdf3e42cdb7a5182130734f17937c9656625218be6c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350168, "uuid": "df801ea6-de27-42c5-8550-c56740581dd1", "comment": "Malware payload (Mirai)", "value": "c6363b4d8e2078194811cd04c3df8db4fc0bfb95", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350168, "uuid": "6df0803b-c180-414e-9b5e-682adb60fa67", "comment": "Malware payload (Mirai)", "value": "60453d5c6e4f981c9b3f79cdb7b72906983dfd75a95355e3fe366742d064592d33883aac134a37be876295785d402981", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350168, "uuid": "1e261c26-63a8-40f4-9298-8840e6842400", "value": "T1BF030A03AA4A45FDD0D6C170566BA53AD837BCBD1238BBBB1B84FA751D32D201E1DAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350168, "uuid": "cf5e0e88-f2c9-4d75-95dc-ae502c5d89ac", "value": "768:wvU9w72uOSY8IXQ7oOxwzLQSOmDyiuEBUljrqppWzgR0:L/uOSYbAM0ULO1q8jr+pWMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350168, "uuid": "5dcb671c-61eb-45da-a75b-20745a4242cf", "value": 39464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350168, "uuid": "74572a49-0943-4fdf-98f9-9a93a786f71a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350168, "uuid": "207ebf52-ef27-40cf-b91c-124bce57f107", "value": "f15682da870e7e206550d1b7c5c29882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2791350b-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393144, "uuid": "131c198b-3517-42e3-910a-1375e6e68f07", "comment": "Malware payload (Mirai)", "value": "5406a59a60fbaa45b7dc29d3b0567946", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393144, "uuid": "f9821471-3611-435a-895b-e815ac242f88", "comment": "Malware payload (Mirai)", "value": "b085ead136190585a8ed5046d1e3c4b0be70c12cbd5edb8c2e2635e74e2480d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393144, "uuid": "8bbbd18d-0abb-47a8-95b5-986b8527c37b", "comment": "Malware payload (Mirai)", "value": "77de89d09784caaac6d90264ce02d548f50a0da2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393144, "uuid": "8b5ca4a4-ba8f-4be7-8033-fb2b38dcac37", "comment": "Malware payload (Mirai)", "value": "b5e62605af218aa6e04cb6615913bc8a506a8c29cb62bc625d1a2b4c81e55146df8b6c2bab4d5165dd4b5ae566ceea2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393144, "uuid": "f86352e7-37d8-4c15-a700-ac4055ec6622", "value": "T10F63085AB8918F01C5C412BAFA1E118D331357A8E2EFB3279E146F6077CB92B0E37556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393144, "uuid": "49c623e4-5531-40ee-a460-977ef0819c5a", "value": "1536:o4noxkyVKe6LL+HvsBBPyU1WYKebekvWcPIviWb22VzbV7:kxkVLOvsBwU0eaZb22Vzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393144, "uuid": "3070e927-c3fb-40b1-99c2-f9db38ae172b", "value": 66992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393144, "uuid": "99933861-60e4-4391-83b7-7ae1e18531b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393144, "uuid": "c1863270-163d-4f9b-aec0-2718f089287c", "value": "5406a59a60fbaa45b7dc29d3b0567946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e563b80-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634392404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392404, "uuid": "50b53737-49fe-404d-809f-099ecbe0e0d2", "comment": "Malware payload (RedLineStealer)", "value": "5a66d163366de0461ea3a97b192f2f68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392404, "uuid": "8bae2dfe-eaf4-4e8c-ab6a-9f7ed88bd0f3", "comment": "Malware payload (RedLineStealer)", "value": "b18aad2f2f6dd798cb2e30e96d2825aa9c21c32611a699790319d94b70b92e21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392404, "uuid": "591ff630-b6f4-4a5f-8eee-970053441c9b", "comment": "Malware payload (RedLineStealer)", "value": "65f3373423fd2620530f3e0551304ad2ea838063", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392404, "uuid": "c099b052-2cc5-459c-bcd7-f4e70b875d96", "comment": "Malware payload (RedLineStealer)", "value": "76d6eeabeabfecb6b5efd72a7e81dc2bc79acb9274fa9e5ea46c3291bc14dc37c696177f9a68e7167c92c7bdad03c3c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392404, "uuid": "a3c43347-45b9-4dc9-938b-0b8be9edfafa", "value": "T10684BF10A7A0C034F1B722F85A7A9375A93F7DE09B64A4CF62D126EA57346D1EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392404, "uuid": "9dea725b-581a-45a7-aa8e-18cffe88fe57", "value": "3053f2a72602e54beffbd9d286711499", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392404, "uuid": "0f84a574-acee-4425-854f-a66a0ae24e97", "value": "6144:0V4oJNYQqbxInrBdHJVjVkM0TJZTNowW6DKxMX5B6WSOGt43GQ2AYH/:0SQNAyrx5VkPdts6GxMXuWxGQ2AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392404, "uuid": "f1d3b578-547f-4de2-b17d-34e75fe4cfb5", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392404, "uuid": "9ab3a194-5b6a-420e-b2f3-b65f80bd1e89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392404, "uuid": "30f86ba1-5000-428d-a913-add2a711a86a", "value": "5a66d163366de0461ea3a97b192f2f68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120bb947-2e58-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1634371633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634371633, "uuid": "040caf5d-39a8-4b69-a486-f86b06c42530", "comment": "Malware payload (CryptBot)", "value": "f3b72059e2de728e8e501e3ad626af45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634371633, "uuid": "e0fcb29f-407c-4020-8093-c9c5b3ef137c", "comment": "Malware payload (CryptBot)", "value": "b1b56f177a463229c447d60683f7420530042faefc2f50077d7dd137ee40ba5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634371633, "uuid": "9d9c07e9-da4c-4a84-a577-c17b7926294f", "comment": "Malware payload (CryptBot)", "value": "1af07d2d24adf92faf1bdf2357a098b3949fdbb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634371633, "uuid": "9ae569b1-0d20-427a-a852-d5358bcb344f", "comment": "Malware payload (CryptBot)", "value": "3f2d2487a020e9b6b04f1a7aeba999663b3213120378f9b76c1f32b968d455c3a8e84e2bbc6d4804311b99514291fa1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634371633, "uuid": "052ae97a-5563-41bc-844b-0e22fa6340b7", "value": "T19F84AF00B7A0C035F1B752F84AB69378A93E7DE1A73894CF52D516EA4635AE1EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634371633, "uuid": "d8cf62ba-d6c3-4f71-86d3-c03d16ce6827", "value": "8d9ee1d37ce0771b137ef02c8f52b4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634371633, "uuid": "98979a96-de08-49e3-b5b5-f7c5643e1bd4", "value": "6144:ohVc2rkTw3AQ0U+cUGh/ixN2r05y1FskG5btnMhoe9E:ohVcI0UXixN75cG5btn+d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634371633, "uuid": "bd75ddbb-d331-407e-b122-3ed343ff4943", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634371633, "uuid": "891bebd4-94de-46f2-8bdd-cf1633a5091f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634371633, "uuid": "3e1411d8-c502-4fb4-8eac-8885850c0f9c", "value": "f3b72059e2de728e8e501e3ad626af45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebb7538-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634380942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380942, "uuid": "d91cd4d3-4cb0-4a39-94c9-e313f5c3b64f", "comment": "Malware payload", "value": "ef8318ccae08f5c5850d746919371d11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380942, "uuid": "06ba9f41-184e-4cbc-a690-08cbe9bd39d1", "comment": "Malware payload", "value": "b39deff26e22781a0b19e7c30040d030d5344dff7e4eb67fe7395b46d3164603", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380942, "uuid": "acb10cb3-adf3-415d-89ba-72a53ce03ac0", "comment": "Malware payload", "value": "3096dff69c45bae2dfaaea88bed7eb6d8b05644a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380942, "uuid": "eac7d433-9737-4769-b6f6-bf67548b9433", "comment": "Malware payload", "value": "70faf0fba21b94cc46fbc45d60d73ac641be681b56b97e9f24e31b9c3c5fe14c618572d84f59ece54282a8bc05fcf183", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380942, "uuid": "7b7e4512-853a-4a0b-b22b-608c6a6e8543", "value": "T15533F13038049915E670097BE4BEC386F3E477AAE1F96381260CE9757FEA14776EC44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380942, "uuid": "9c150354-678c-48a1-800f-bee0a14382a9", "value": "768:BQIWV7nBmCUc9t0HnlocNu2+R3xBL4l3dZS5s0KhihQ3q3U7Z8mxNaOZBa6H:BfWV7Bk9FB+zBUltZFKQrKmzFZ7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380942, "uuid": "1fcf6988-db08-458d-8e1f-3cbbc9e6d738", "value": 50140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380942, "uuid": "e9693f69-2aa8-4b09-ac73-31014b8fa966", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380942, "uuid": "b9bc069a-bc6d-4586-8c5d-c2744c9ef502", "value": "ef8318ccae08f5c5850d746919371d11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454be206-2e74-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383745, "uuid": "96b4de25-caa3-4629-ae00-d38b2827e8d3", "comment": "Malware payload (Gafgyt)", "value": "720338cc312eb25d89eadce8b26359da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383745, "uuid": "26f84170-ada6-41c2-b96d-7960b989a0db", "comment": "Malware payload (Gafgyt)", "value": "b483e646b97b0458047b654f94baacfd31b263e6e7e082213ad7a4a7f14f7c1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383745, "uuid": "ca09950a-d213-4c12-8447-92f83e293bcd", "comment": "Malware payload (Gafgyt)", "value": "1afb1da35b7bfc194fe381366680493e2bb6ce70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383745, "uuid": "01947925-6d29-4c54-93e3-cf5db8664c35", "comment": "Malware payload (Gafgyt)", "value": "e7fd7efd8bb2053dcfc5d7804ec87330d86be3c302edf991c58227051f523179bb520bc37285b9ac2af8169cba16319e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383745, "uuid": "3309db10-a900-48c5-9c93-d22c2adb166b", "value": "T1AD930892B901DFB6F40ED77A04D34724B670FBA24E531A72731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383745, "uuid": "5f0a30b1-38f8-4ead-ba11-fd3635b47af0", "value": "1536:4wZVhxpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gLd2f7vTmQ9VqXjewf2Le:R3p09W6KTG/IB6Yy36uYfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383745, "uuid": "59ba1958-dfa3-41ca-b3f6-dff4d5145563", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383745, "uuid": "8d2f5aff-9008-4265-b015-4965051b9da3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383745, "uuid": "b42ba9a4-bf2d-4a51-9c4b-c2c64493ec79", "value": "720338cc312eb25d89eadce8b26359da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4a3b9d-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634394605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394605, "uuid": "529a0988-18ce-4cf5-b0a8-f026917929b0", "comment": "Malware payload (Mirai)", "value": "b4daeb2c9ee5324595974a120beee955", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394605, "uuid": "f0fa1235-2a80-4d6d-b871-1058c237f1f1", "comment": "Malware payload (Mirai)", "value": "b48c2f69a7731f5f4ab764cba753ed2fd85da01cb9c2ef157521926dcea25fce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394605, "uuid": "dfbabc98-d1ce-4e8d-b11c-4de2b2d76b18", "comment": "Malware payload (Mirai)", "value": "9250569674ff1b198c7fcdfd3435de0f429ba551", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394605, "uuid": "b2d2555a-0f67-45a0-975c-5561d564a232", "comment": "Malware payload (Mirai)", "value": "b61867e0106a57c7554b16f304194675a7face9e4c7deff87adec561d7764172d4d26a6aed5128820306c804a4071a64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394605, "uuid": "5dba634b-5357-4e59-96f2-8643685b45aa", "value": "T14333F17290C6F172D033B874B5BB0EE2F384DBF845576A281D465DC8CAD2841ABF85A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394605, "uuid": "34d18d3a-4dd6-4d1a-ac95-3afa52f6dec1", "value": "1536:3mr3Yrg7AuBN9SWVAixwMlLwSQ3d5cVlB3tmqLMVB9:zrg7bBnlVAixrWcmqLMr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394605, "uuid": "9c095c25-ea07-4ade-bdfb-050e7ca084bd", "value": 51980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394605, "uuid": "4a85da3e-222d-4dfd-acff-a36d771290a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394605, "uuid": "4578598c-74a3-4d45-afdb-675d93a2106c", "value": "b4daeb2c9ee5324595974a120beee955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c6b459-2ed2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634424223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424223, "uuid": "38b35ac2-9fd4-4d7f-989d-81ef408e9952", "comment": "Malware payload (RedLineStealer)", "value": "06d45d30ef46764b117b593baedc0f74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424223, "uuid": "946c69d8-31f4-4911-be38-ba1b197d0093", "comment": "Malware payload (RedLineStealer)", "value": "b5fb89e564bb6fd7432c7bb71adca535e38673b7551ec7a0265ac6ba0de5e613", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424223, "uuid": "e4a9374f-45c9-41b5-9963-bd88b0d979be", "comment": "Malware payload (RedLineStealer)", "value": "02ded5ba3d62e74a5fbb8d6443387cc127290db8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634424223, "uuid": "9cee8c6e-2454-4128-989c-0d6fcdf7fb44", "comment": "Malware payload (RedLineStealer)", "value": "c5824f8caec71131d1f4ab178e235d3cdddeb9e3c0dd3be2a517d35918207eff1ed8287e8a5909f7a8788cf613287370", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424223, "uuid": "fc0678c0-9226-423c-818d-de996450dcd3", "value": "T15E949D10B650D035F5F366F98ABA9368A52E7FE06B2450CB53D41AEE97356E1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424223, "uuid": "fadd7d48-4a1b-4897-8813-6e8bd523bd84", "value": "578dc7dab5389346cbcc286cae0d11e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424223, "uuid": "9397cadb-61a7-4913-9420-5c8254f13242", "value": "12288:JRLXHTIgxeH+CKQRFnq3ZWYpdpKn14L8EmP7Lo:JZHTIggH+CKMFOZ4n14LaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634424223, "uuid": "d27dade9-ef9e-4b78-9984-6aaa5ec711c3", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634424223, "uuid": "d52ea4e9-ee12-4c1b-9b75-a27d262f37f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634424223, "uuid": "ca988b9f-f2b9-4b0d-9fe1-bb505c309afc", "value": "06d45d30ef46764b117b593baedc0f74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29636c1-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634350481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350481, "uuid": "55b635d1-0803-4282-b378-7fdc22a9f3a3", "comment": "Malware payload (Mirai)", "value": "19e0a86a6d80745beac7d2362c08ea13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350481, "uuid": "dd81190b-747e-40bd-8ab3-1cfd111ad415", "comment": "Malware payload (Mirai)", "value": "b790dc560499864cca27d4d36bd72347ae12d8a2bc02660ad36604fd02027d82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350481, "uuid": "a21e365d-cad6-45b9-a8f6-7502a7d1336d", "comment": "Malware payload (Mirai)", "value": "9367777fd52aa1ccb62f74795e2a0c0cefa725a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350481, "uuid": "51b8f8a3-d1ad-4ced-a293-809ad9fd75f1", "comment": "Malware payload (Mirai)", "value": "3d5ae03a0caa041fe73460e18f878d6dada0f6297ba0260759823dea1598e5c9aea3d58c0f97b6b55d05ec8476a4ce9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350481, "uuid": "d69abb0d-14f1-412a-934a-c984ca944d22", "value": "T132137B36F4391C65EC5412B8A665EAB48353ECB191A73CB29ECDE4850473A9CF88D7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350481, "uuid": "0da0df25-b919-4ff0-b6c6-f71611df4717", "value": "384:YNEQwQh4ySWBgVJABvHvwWkjpCvri7G+eMcqybi4yjqCKzHhiOnXbk+J81dZO4lF:YNfzCykflWkcsIJy/mHhvQRA4lqTqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350481, "uuid": "2e41fbcd-7084-4158-a237-46997e214581", "value": 42484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350481, "uuid": "c18034b6-f359-4754-9696-13b90ce0d257", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350481, "uuid": "9b4c9ed6-b991-4d15-b3c0-cb8a6c4f6302", "value": "19e0a86a6d80745beac7d2362c08ea13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa69c34-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634393391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393391, "uuid": "996a1669-cf6e-4723-acc2-bf9ea7deb504", "comment": "Malware payload (RedLineStealer)", "value": "996f740f90e5bb43855758020221954a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393391, "uuid": "73a077d1-5b71-403b-be66-891fd7258015", "comment": "Malware payload (RedLineStealer)", "value": "b7f65cec4abf8f2d372ec423a4b170596bb6c4db9ec006281ba2ffa718d575e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393391, "uuid": "91d8e3d6-ef13-45aa-8781-79db4fb72487", "comment": "Malware payload (RedLineStealer)", "value": "12b4c0bfe7204e98f87de483c540d4af9a27591a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393391, "uuid": "efd59fbd-5894-4d16-8ee9-8200f83bcda0", "comment": "Malware payload (RedLineStealer)", "value": "a367e364f4034e0bdbe2105c07caba2448d2f5d1802141bb4107a0646c3a21c123e734904b4a4ef32b1257e1b741ec50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393391, "uuid": "f92499f9-8df8-4bc5-8141-1de31846d975", "value": "T1E0056BC7E5B3608EE7A3B4794F0215824A420E762F259AF56F31EA2B11F3761C997313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393391, "uuid": "f3ca328f-ab11-42e7-ac3c-23ef24f87327", "value": "d884068331e476966244675d20ec28e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393391, "uuid": "5ad55111-0a44-40ba-bf74-9295f9c0eb8b", "value": "12288:+QRjVffMpBqo6nP2300JapkZXoeoGiq7d1pOeAB8xwWsjJcBa8UYpFATsAwxLG:+skoQiq7d14kxPzUYnIsAwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393391, "uuid": "1d3f74d9-2e48-4c3d-8e3b-1560dd54a6f4", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393391, "uuid": "d10a7633-0b63-47b8-885b-c4d904d7f790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393391, "uuid": "c27641d4-4a16-4f9a-8510-5df9d632951f", "value": "FiveMMM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96afd578-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634394619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394619, "uuid": "cf7820f0-00fa-408d-bd98-4124d678cb27", "comment": "Malware payload (RedLineStealer)", "value": "d56da61263081d38e08747912e88bce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394619, "uuid": "996002c8-c5e3-4d31-9d4c-d02aab7d78d0", "comment": "Malware payload (RedLineStealer)", "value": "b811d4846756f182709e84203a4c2b146877251ca4b13e7a0e08fefa73dcabfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394619, "uuid": "524d17ec-9ca1-498c-83bf-3b87ec14d821", "comment": "Malware payload (RedLineStealer)", "value": "9b4b58c955dcc8f20add44b66f7349ded5b64d5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394619, "uuid": "77ccd43e-28d5-46aa-9af6-780194b8d0c9", "comment": "Malware payload (RedLineStealer)", "value": "3f590cdcd791588cf0b65e0d10e6de3cc78b89b7d8a5c3364af8c22722021e6941241f641cdcf62ba1b21ef9657b9a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394619, "uuid": "87686e3d-3ee3-45ee-8013-f88a137eeb39", "value": "T1C884AF10A7A0C035F1B757F847BA9379E53E7AA16B2491CF22D516EA8734AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394619, "uuid": "67e0943d-87f8-4b67-aeb2-e5690aa65dc2", "value": "a273bde2272833f250fbe3525ddfb3d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394619, "uuid": "4c77c665-ee0c-4b7b-ac89-58e392e4c87b", "value": "6144:qhIThNgnnTAReO9KcYZPyXYNU4ih/CdcPm66dJo8j9vsv+i:jNanT10XY64ih/CdX66dJouO+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394619, "uuid": "db2de47f-68fd-4c0e-aa53-065cf70c3301", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394619, "uuid": "eecf8e99-a490-451b-a195-7cb0276d126c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394619, "uuid": "c98b6661-3871-480a-a1f4-c1dc4013a8b9", "value": "d56da61263081d38e08747912e88bce6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d91187-2e42-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634362508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362508, "uuid": "c67c0def-8e4d-4f65-a0a6-4c93cd58eb88", "comment": "Malware payload (Mirai)", "value": "026f7105cee9b9ea5076658c5bba6c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362508, "uuid": "aaa88c54-0c73-4be8-ad34-398196647783", "comment": "Malware payload (Mirai)", "value": "b92f8ffa6626b97c99baaa2e631a23ba23883de66b091ef8c6977811218eaceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362508, "uuid": "a3068df8-fd77-419d-aa3e-fc9ec11a8553", "comment": "Malware payload (Mirai)", "value": "850e80de98d114e96d20bb593472de3795d9496b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634362508, "uuid": "a684aaad-efb2-4e2c-a6f5-1e9c8cd8ba8b", "comment": "Malware payload (Mirai)", "value": "10489dfd2ee20ccc2cb7b9d771aec799a0c60a9a0207b935a6e506b0a61b6e5a3fdf80e222b25e6f7b130ac6c88d2597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634362508, "uuid": "ddd136b2-dcc4-4cef-b553-ac54824d7419", "value": "T1AFD2F1F8EF789B8BD0D5A73A4D5D9C0E71ACBD671AB6E5180B420D222039E60D5ECCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634362508, "uuid": "7b0ca696-f62d-414e-8c79-3a92b8fcf1a2", "value": "768:XN8fWlfoQmQAXV7E/QciiRcrHKOu3rtq+:dMNXFl76NnJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634362508, "uuid": "6e51c5b7-44d5-454a-98ad-0f925054843c", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634362508, "uuid": "38b33fed-9ddb-49c0-8499-be34803ebc2d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634362508, "uuid": "759af295-6788-4e6f-be0e-fe3853bd5624", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690436d1-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392395, "uuid": "7feb89b0-04c6-40ba-bd85-35044af20297", "comment": "Malware payload (Mirai)", "value": "a32bb5287f4d39d955723b4cbcdf073a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392395, "uuid": "921e84c9-a163-4f40-b15a-2c987654f0ea", "comment": "Malware payload (Mirai)", "value": "b9885b77fb51673d8d9835c1f784b2398d2c94ecb97433c335e93cadf62c876b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392395, "uuid": "285089e4-0f66-471c-be42-facad15e2f6e", "comment": "Malware payload (Mirai)", "value": "7cf95f8df2739f8d988816a8d340e4d013db2bd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392395, "uuid": "e2a58113-b2b9-42a4-b06b-0397352a5f93", "comment": "Malware payload (Mirai)", "value": "e210fc6e2b48395c4ac86a1ae1ec37d1436e94273b7d460100ec7f68ed532890baf7d6eac03d6ebedc067ac1d081d3b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392395, "uuid": "8ea22224-3716-4791-94bf-f2583f5d18ec", "value": "T196D2D03E565036CAD7CE0D7C886DDB22ED44E5C0552E9F2DD3880866ABFE403BA8E075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392395, "uuid": "03654a62-b45b-4e4d-9078-8b444d40c6a6", "value": "768:OpERrxcOA/b1mhhFP+qvlEIV6OCyrMxqlpojyWMO:OpnOmMhHvlrc5oMiojP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392395, "uuid": "575ce66a-41de-422b-a947-252cad24033d", "value": 29752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392395, "uuid": "0da0fbd6-8528-47c3-8ba0-e56fd64ccc33", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392395, "uuid": "e9d2edd7-349f-47d4-8837-b86de7897ff3", "value": "a32bb5287f4d39d955723b4cbcdf073a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef91e56-2ec3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634417638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417638, "uuid": "e3c189d9-197c-47dd-a811-ed31f0371af7", "comment": "Malware payload", "value": "b6d5dbbdd130a2b1c975e50cdc67f004", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417638, "uuid": "36ae894d-32f3-4c74-a5d0-6f106d7cb241", "comment": "Malware payload", "value": "b9e314f7d7ef50541acfc949b583742bc54556dc9912970ef53b3217f3e0b18d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417638, "uuid": "3b514c86-6deb-4a42-b5e8-f71b7bf5edbc", "comment": "Malware payload", "value": "388f6434054dbfd4e7f6edf608d06f4fab761d40", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634417638, "uuid": "4101e3d0-cf8c-4a2f-b2b4-fa86969fdd5c", "comment": "Malware payload", "value": "2a8f4e1af537f240831eb2a2f69f0141f13ed0e10f6751697a9ce3a87daab41df60e6714184937f8c35c08d9674f5851", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634417638, "uuid": "22c53401-007c-40a3-b9ff-a1f6f4db47c1", "value": "T12DD0A7F725A116459B0090E85348765CD737054D2DDDE391D3906D36C414870AE00610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634417638, "uuid": "90bfa88c-8c2d-4837-aad6-64679cb0935a", "value": "6:2sidNE9Q+shDacymRj38RehOrdaLUeqP4M4E5n:2siPE9QRGQFh+e4sE5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634417638, "uuid": "687acfb8-4d0a-48f7-82f8-00f55a44e224", "value": 230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634417638, "uuid": "448d5e12-44d0-4c29-8e21-73ceb257ccd9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634417638, "uuid": "867bfc31-5f27-477d-8bba-782099ca02e4", "value": "df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15748a0-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634394664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394664, "uuid": "7bd5dc22-f472-4bb6-b978-dead6e74d944", "comment": "Malware payload (Formbook)", "value": "09c8e4c071be047a8e47bc7da2144a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394664, "uuid": "ae8ded67-48b4-46ce-8a59-666986cfe028", "comment": "Malware payload (Formbook)", "value": "ba22bb07f3ef12877682493d25ed29cf6e2ca6c9ce2bc9527396a7bae00ec578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394664, "uuid": "320db957-1ed8-413b-9beb-cd3463f68628", "comment": "Malware payload (Formbook)", "value": "ebe0d1423ea1d9111bcac875837e836682bdbe31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394664, "uuid": "89a76e43-5bff-4bab-844c-ceac56d57774", "comment": "Malware payload (Formbook)", "value": "5d1bb14eb56ed9773a0f5f1c07408607fff13b7c82842041bab1c13db9bf00461820a8f8e961eab5143a7b23f3e93f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394664, "uuid": "c5a7ab50-c86b-49af-b84a-68a8e54e232e", "value": "T16B74019613AC923EC6B21FBDA41D111E73709D2958C2FF4F864BF9D318A53830E5168B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394664, "uuid": "d2db8a5a-8c12-41c9-a424-87aab37cc500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394664, "uuid": "5bb6f997-6a32-4547-9746-455888b80534", "value": "6144:3Rpsi24MkhBccsES9FfFi4v4ItBQHxkd5NaLTnBN1ldf3exC1K0wn0hReJywp54O:3RSi2TSBch9FfX4ItAkd5Na3dl5EMO0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394664, "uuid": "299b237d-6b88-463a-9bcd-2fe64baabaf0", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394664, "uuid": "c9babe53-43a4-423d-99d4-3f269c5fe05c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394664, "uuid": "2453842f-4629-43e8-a1c3-1e2712d44e5d", "value": "09c8e4c071be047a8e47bc7da2144a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f51872-2e74-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383768, "uuid": "18e0f13f-2b05-40fb-8514-f0262d8c1b8d", "comment": "Malware payload (Gafgyt)", "value": "dc8aac7ceb40749546e012e57665e9bc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383768, "uuid": "4f780b5f-858a-49fe-bdd9-8ad005e7010a", "comment": "Malware payload (Gafgyt)", "value": "ba5f2e8be9a5e26d6955db573a3ba5acf85e277ac4dec5bd8a166d9fed95e566", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383768, "uuid": "dce26aa8-b880-41d2-9510-7a281537e3cb", "comment": "Malware payload (Gafgyt)", "value": "e24b0fa4f622ad953e71c568a6640ee775a697cd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383768, "uuid": "f77b990f-a6d5-484f-924e-61b00479c266", "comment": "Malware payload (Gafgyt)", "value": "46c2fde37c6669a3f5d7f00513054c3db2ed219e9cd0a7ad529c315de08595d4aa8f043e8e05f4eba6ecd47ca010977e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383768, "uuid": "512acb82-f536-4197-a9be-3ac85557d43b", "value": "T175836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383768, "uuid": "0301cc70-75b4-4fa7-acff-f089366eaa99", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XcuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XcuDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383768, "uuid": "73f365ea-a47d-4793-a2e9-47892ff60b17", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383768, "uuid": "59a06112-7ed1-4d2a-a8e7-89bf582e79d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383768, "uuid": "ecd2d26f-a337-4f20-848d-e4adc3150563", "value": "dc8aac7ceb40749546e012e57665e9bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788d60aa-2e73-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383402, "uuid": "9d234307-03be-4ac2-a14a-18aebbadf4b9", "comment": "Malware payload (Gafgyt)", "value": "722a1d4fddde03bb651901d56c44eff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383402, "uuid": "e63543a9-a401-4742-9757-1f85e29cd935", "comment": "Malware payload (Gafgyt)", "value": "c016174f3a6304c8f5f6df44db0caf26dd3fa32ebfa5099a3587aee3b85447ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383402, "uuid": "4220c265-f8be-4ca1-bed4-5b13df5bacec", "comment": "Malware payload (Gafgyt)", "value": "09577e718fba43e44c89522bc74a5306d936be22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383402, "uuid": "fb4ada20-df9c-4080-aafc-e6c1719c462f", "comment": "Malware payload (Gafgyt)", "value": "f6cebaec4e6212366355a23845c2104ae4e9811cfab39d7bf5d6048acc7937322cbe9a830deb2ec43993361447489919", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383402, "uuid": "15085e69-c4ae-4ef1-ad3e-80df0d4bb0eb", "value": "T16B930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383402, "uuid": "10393d34-0f10-4789-84ff-da9c5d2b566b", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOx+ePczYrmREqQ4b/X7XSee:OQ2HYBv1WTfePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383402, "uuid": "6d610f20-de0b-49ea-9f2f-4cc3ace8ecd9", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383402, "uuid": "669759aa-ccdf-4741-8b5a-b41d18b34540", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383402, "uuid": "5c907853-7d9d-4a12-b9ef-49d3f04122f2", "value": "722a1d4fddde03bb651901d56c44eff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc845f9-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380270, "uuid": "189de083-98d3-4216-8ec9-7f5d561ca4a7", "comment": "Malware payload (Gafgyt)", "value": "0bdbd29dad972c04e3650e2f88253416", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380270, "uuid": "77924da1-5920-46b8-8221-c8ac553fe5ad", "comment": "Malware payload (Gafgyt)", "value": "c0fdab1a7975b5b96c89f1aab192aac296be836c8808a9db183f020d30c43d66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380270, "uuid": "d55c3be2-a74c-464b-9259-fe5ab46bf49c", "comment": "Malware payload (Gafgyt)", "value": "d9c5025b7fa9152a718caac902df33ca9e9a16ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380270, "uuid": "907ed99c-26d3-43cb-a078-84d01ba710c3", "comment": "Malware payload (Gafgyt)", "value": "b23dc3119ab9f7a729a362e910c002dc95f8b158344cba2262dc4a41e71c4934f13b377731f5aabc2c12f3de0f4157f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380270, "uuid": "b06d533d-f588-4baf-b951-a0fe19adc83e", "value": "T10AB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380270, "uuid": "de819452-8a1d-49e8-b565-6d691f6b8664", "value": "1536:ZLeTGkthhSMOCMQS+ZjN4pjuIxreg2Oqt2eDo/LUmkiSFxfC7xbXe:Z5HC3S+dUreHtTDCLUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380270, "uuid": "ddf379c0-a214-47dc-ad64-3371caee48c6", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380270, "uuid": "fb989ec5-c4ca-4ecd-886f-37ffe1a6ce7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380270, "uuid": "ea2d9131-aaad-4176-aab4-a64e37f2a43a", "value": "0bdbd29dad972c04e3650e2f88253416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb9c3de-2e8f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634395406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395406, "uuid": "317a8ac9-8144-48bf-84c6-855cc7293703", "comment": "Malware payload (Mirai)", "value": "7b98e936729a28fa2264303b8babec61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395406, "uuid": "7c1a9f2a-5298-43ee-b1e8-e31c39a5002d", "comment": "Malware payload (Mirai)", "value": "c144e52466c3f0620937eb9ee8df5b3c3f6ef1f892d098431eabb9a4bdca4e5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395406, "uuid": "63efbda8-332f-4fa9-8845-cad918e6e777", "comment": "Malware payload (Mirai)", "value": "b1cad7ed5643f05bdc1edef40d9a4dafe2c9ace0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395406, "uuid": "f6305607-c4c1-4337-a539-f826f10d80da", "comment": "Malware payload (Mirai)", "value": "f28d5de6da25aa7e5532667e4d9970b86af55bdc83ef8949226720a4c0f89e852f2a6259b32e82f014bfc0120c11f14c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395406, "uuid": "0dba7948-731b-4e80-a073-76c2b1a31ad2", "value": "T1EC339FB6CD6DEC84C1694274B5348E385763E904AA961FF59A87C2628007FECF1393F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395406, "uuid": "5b39b0eb-f13a-4842-8466-ce6e9c93cbb1", "value": "1536:+/TCZLmgFLar2PHtrAkaj/eg/I+SLBhCKN:+r0SiL5/trAk4I+SLBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634395406, "uuid": "b7455326-8eb4-4eb3-b700-c7fdb2f75a8f", "value": 54504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634395406, "uuid": "c2b94153-a746-444b-93da-7db479ef71bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395406, "uuid": "93a69130-c801-4267-a60e-af3610312864", "value": "7b98e936729a28fa2264303b8babec61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cab64f-2e7f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634388605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388605, "uuid": "b68887fb-ea56-4c83-abd9-08ff8f5982d9", "comment": "Malware payload (Mirai)", "value": "dc4776384fb5bd0f87ba466d2e0a78f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388605, "uuid": "d88d31f9-3043-4466-9619-3b4863dd5182", "comment": "Malware payload (Mirai)", "value": "c32e4231749afd7189ce7810323edbead1ecd56da6a7c33c2b40c946f765509c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388605, "uuid": "d9990427-b969-4259-8861-c33591fca0ce", "comment": "Malware payload (Mirai)", "value": "7f2c4dffc16f6d0e92f329f7c4d73fa909f31ff5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634388605, "uuid": "fe1de629-8bd3-473f-85e4-1ccad0b00750", "comment": "Malware payload (Mirai)", "value": "51b8eece2b4cf74b05af07166d845dfaab8a45b54285119bc1d635e4ce034bd21e9a8d85773f2f873a68e61e7e134db2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388605, "uuid": "f25a8fc8-e9a9-43b1-a7b9-bb4d42d9defc", "value": "T1F92302032093BA03F0345CFA45628CCDB50EA6BDB1BE77A725490E254C759A2ECB1CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388605, "uuid": "86a56c7d-37e1-4a46-b93e-343bdbac2096", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iF2Tdp9q3UELWt/iw+kvBGg6+fYtrBHG:E12O1LCNguovDPH7Tcr6cLWhiw+kvBGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634388605, "uuid": "42097e82-5631-46e0-a8fc-7245d7e33cb6", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634388605, "uuid": "490e1f51-07b1-4009-b15b-7e917833df70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634388605, "uuid": "81ffd279-9f40-49c6-844e-6652973c69a5", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e9ddc0-2e6f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634381520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381520, "uuid": "377b0ce8-82e6-491c-bba3-03d17e5c857c", "comment": "Malware payload (RedLineStealer)", "value": "7d09810664be0b0d9dab03e6652cfb26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381520, "uuid": "f9e89f16-ae6c-4dc9-8dc4-769a20c3cc01", "comment": "Malware payload (RedLineStealer)", "value": "c4426a5f81ed451410f2a960676087b5f4e3d1cb04b3efa8549486df5bf1d5bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381520, "uuid": "f463a00a-4812-412a-a15f-440ec2c3b3ae", "comment": "Malware payload (RedLineStealer)", "value": "3f5230cd0e7e11e671148aa2ef5379bf724e6572", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381520, "uuid": "7e3ba4a3-af73-45fc-8d85-9f2bc306530e", "comment": "Malware payload (RedLineStealer)", "value": "aeeba6eb1eadd379cb3e166d84bbfa8e0c93f566c367d01374ac25387d70e51140cc1a7b2441d550f9c702ef4e942bbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381520, "uuid": "4c9f3087-6995-438b-9719-35ace821a94f", "value": "T13543A77B006550A6C5482334F4A10F0B7ABCD6351981B65CB08BF3EAEC1D69DADF83B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381520, "uuid": "778ec098-41ac-4f14-85ca-9b8095673473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381520, "uuid": "b7b6e31c-1251-4fda-a19a-a347c8a5afa3", "value": "768:3bRqa08gr0BAFIa9ymm1/xs5O5+earyji4Sk13U8M4WQCXqA/vOx+/9vsNtQUSdi:3Y6XmFR+v5+eaVkhBWRCg1sDSNCWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381520, "uuid": "717f3c53-3f8e-4117-8db7-3b1fb7af48ee", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381520, "uuid": "fdf24b5b-7141-401e-9007-f48991aa7dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381520, "uuid": "253e9c5c-38e8-43f6-9dd7-e732fa4499ee", "value": "7d09810664be0b0d9dab03e6652cfb26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcf6ac9-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634380968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380968, "uuid": "4da4cd80-600f-4ae6-878e-c3f9aeeafd3c", "comment": "Malware payload (Mirai)", "value": "984f86c4198c800b3e4524766b28d4a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380968, "uuid": "ddf842c1-3347-48ff-af1f-4fb2c20f0289", "comment": "Malware payload (Mirai)", "value": "c444fbbdcb455ca9adc1d283a319c81dce1ce47cde6c98e4e1105991ac2d6e52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380968, "uuid": "658d1e29-8c66-4417-866c-f462e05f6d13", "comment": "Malware payload (Mirai)", "value": "51bb445f6d91d260b1a27ef6a9127480e5654365", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380968, "uuid": "5c3edfd9-b928-4f55-afb4-8cb13c532c79", "comment": "Malware payload (Mirai)", "value": "bdb0eb2e67859973c2fd49fd23f6c407269faee703bddcf423863746a9fa742d1fc069749ea178d9389169b20da6c0dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380968, "uuid": "2fea0147-83c1-4682-b9c6-f5282d0386d5", "value": "T145231882BCD29A1ACAD46376F62E108E3321B3E9D1DF3257CD145F007A8992F0D67B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380968, "uuid": "c9c14b25-b7e7-4256-88af-08f95c1bc8aa", "value": "768:hUN7umfVLvApIf+AdOBAzYuCpoqvvnDg7SLjasonjFGBN/q:gymfB4Gf+AdOBAzY3iqnnDGS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380968, "uuid": "5d5afadd-9555-43a2-99e7-1d54df5defed", "value": 46316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380968, "uuid": "cb0b360b-a544-4f13-bf6a-e6fc0d8aa636", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380968, "uuid": "390aa649-668e-489d-be04-307208eb4f40", "value": "984f86c4198c800b3e4524766b28d4a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b748978f-2e6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634379641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379641, "uuid": "a42d435d-aee0-427c-a478-5599416f7efa", "comment": "Malware payload (Gafgyt)", "value": "0be4c7c3d80604ab76f6e3d56b60ebdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379641, "uuid": "a228ce0a-4869-4bdd-ba1d-f64134365df7", "comment": "Malware payload (Gafgyt)", "value": "c46754ae5a0081366e0ac16e9d3469ef467b572106f5b41f6f65d5d7ed5b657b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379641, "uuid": "b8ea3347-b6a2-4a87-bf38-1904bb91c89b", "comment": "Malware payload (Gafgyt)", "value": "cbc396bead1e5bf1262cf4c1f8be0764b0b2e7d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634379641, "uuid": "ef3de0bb-d33e-40d0-a7c4-f7ab3d835574", "comment": "Malware payload (Gafgyt)", "value": "402d4b7c36295c518fa57b9382c5c09c437cd7a3585581cc6496e5f57db72ac655ae95d2627b7af3ccedcf75ee0f862d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379641, "uuid": "8ea10c27-e7df-4e6e-9731-8ca8ada4d063", "value": "T163931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379641, "uuid": "8911a34f-2880-4612-a28c-7e4de1ac11d9", "value": "1536:EIkg9VQPAWlMTEb82Mm3xDKMsF0rOLcvYNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQBMTDWWFGYNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634379641, "uuid": "2852d594-a02b-417b-a903-31743859c6bc", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634379641, "uuid": "e8954b6a-ca90-4ae9-b2f6-282e815ec6b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634379641, "uuid": "eade110e-34ee-4454-a99d-91e349f9841b", "value": "0be4c7c3d80604ab76f6e3d56b60ebdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cd4156-2e87-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392205, "uuid": "10136464-b61a-4f3f-9fab-4b8c8e95294a", "comment": "Malware payload (Mirai)", "value": "a87b7aa12149dc2ebdf2760e15d0a6b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392205, "uuid": "5e879ed9-07f0-402c-ad35-621b562ed8f9", "comment": "Malware payload (Mirai)", "value": "c4adf9c6389ee0e52a162bdf22d3c795791e1df0de9648dc33b7f3b497d14314", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392205, "uuid": "3c7363ed-2967-43e6-a0a1-4ebcf03af753", "comment": "Malware payload (Mirai)", "value": "e4ccfe8b2f5d4ad497ca9978e23e97f21a584de3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392205, "uuid": "f2c2966d-d08a-47df-a2fc-d8c8b497f8b8", "comment": "Malware payload (Mirai)", "value": "4005576473de02838a616efdc1bc40ddfad3d8fcb39d642d82915860045d9abc3cdd1ec97053a6b9353ead0f23e0f8e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392205, "uuid": "9e343e14-5c91-4bff-9081-3e8518871495", "value": "T15BC2E121E78248B187A10E73743FC686318936BFA00B35F06BA0867C99C35932A7D41D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392205, "uuid": "91ddd91f-fa6c-4cb3-89b1-04cc945f2af8", "value": "768:ul+WHcRJ2sj7GjYRMkfmaS/KKyKWXfqIfp+H93UW:u9cWsOMRMkfmaSiKsXSIBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392205, "uuid": "073f96e3-f4f0-45a8-8bdd-2ccdf0d2185b", "value": 26704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392205, "uuid": "bb598e1b-54a1-4687-a0ed-e4193cf69cd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392205, "uuid": "792c1d0e-661b-4c16-8dc2-e2ba49cdded4", "value": "apep.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f6a1a1-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350156, "uuid": "13265c37-2309-4a1d-bf20-cfacda7cb0bb", "comment": "Malware payload (Gafgyt)", "value": "d192789f9c9224e6a40a95528af0d396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350156, "uuid": "958725e4-bcd7-4ef4-87a2-40c9ca1434d2", "comment": "Malware payload (Gafgyt)", "value": "c560fdd377fc7dfb9840e90665f4ab576f5b4d3220729deb994b70fcae467d6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350156, "uuid": "6715b940-4cda-4a29-9426-26dd43bb4258", "comment": "Malware payload (Gafgyt)", "value": "bfc1af7159e834165411eb5716a24538fcb2f567", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350156, "uuid": "5290d7cc-e630-4254-a2d9-a9302f25a874", "comment": "Malware payload (Gafgyt)", "value": "cbaf7607d4ca5a6f0a7311487d877000c2e4931712a16d873d795bbc80ceed08d86493d2909b42f62383299cc1560bd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350156, "uuid": "f9ce4406-9396-4722-93ef-6e4b5ab16b7e", "value": "T1DBB31B41F8418727C3E327BAE78E438D3B35569467D733116A38BEB42BC5B992E29530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350156, "uuid": "ad2f983a-e5f4-4ab5-85aa-0dcecce0ba1a", "value": "3072:dCziIW9UbUVMQozPCNPE81zcmAtrQAhPDOXkks:dhebxQozP6timAtrQAhPDOXkks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350156, "uuid": "dc57532e-a836-4290-b651-960acc27a6d7", "value": 110179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350156, "uuid": "a625a8fb-8e91-408c-a88b-495974da4773", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350156, "uuid": "0bc55c43-0677-4209-946d-94addee2aede", "value": "d192789f9c9224e6a40a95528af0d396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277430f4-2e77-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634384983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384983, "uuid": "4fd19d85-33ff-4432-98fa-167f10bf70cd", "comment": "Malware payload (Gafgyt)", "value": "46df601fbe13b6684ddfe76d5e9100d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384983, "uuid": "523b29f1-f21d-4de4-8a5c-d0601196f5e7", "comment": "Malware payload (Gafgyt)", "value": "c5b8de3c60aaf6afcd9557636a1359ddb35192e5bfdd70805ccd888afbf36ffb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384983, "uuid": "d43c35f1-f9e8-4abb-8b14-36b58e255354", "comment": "Malware payload (Gafgyt)", "value": "00c113011f4c8a4323a16eb6208e98cde3c8207a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384983, "uuid": "545c0318-a7a1-4a10-ac40-661a259cd48f", "comment": "Malware payload (Gafgyt)", "value": "c5a85c79061e629cdd5699f1e0f633e2717fcb51c80a4801a1cffa1ffb4d77b9f00bb036eca888347e68d03c158154c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634384983, "uuid": "6f0261ae-76ca-4427-9999-f0db56710d15", "value": "T1A8A32943E5618FB7C0466A7525AB5E340B63AC922B4F1A853128B7F4033B5DEB81FF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634384983, "uuid": "b2551434-1c1e-4e09-83d8-74c7716dcb5c", "value": "1536:SlUz4qabHDRXmaKASi1jjMWYXCHeCkon8AT8ymK4epbbSLEn/6NS:SlMabHVXsAPjMOeinZmHepbbqEn/6NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634384983, "uuid": "157d37ca-044e-41b9-ae8a-140048767e22", "value": 104485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634384983, "uuid": "e0465fc8-6bc8-40f7-89f0-46d129e603fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634384983, "uuid": "fa404e4c-6cdc-4891-a6fd-f09e015cbd01", "value": "46df601fbe13b6684ddfe76d5e9100d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a7219d-2e25-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634349896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349896, "uuid": "c91405a2-b6e6-4b0d-92c8-7c886989c5ab", "comment": "Malware payload (Mirai)", "value": "248db6aafaf0d1595c6fdfb2b3e79276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349896, "uuid": "c507e671-f173-4435-9119-13f09ee85953", "comment": "Malware payload (Mirai)", "value": "c8914ea451d41f7e75e8b03c649b7a53a4aab52cd2f517f1d93dee19ef5221b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349896, "uuid": "61463a1b-589d-47ea-b162-9103ad249bad", "comment": "Malware payload (Mirai)", "value": "d5d24bd25c4b0ccbf65b631e5db7ff4a9d56fd06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349896, "uuid": "7ecd7aa7-6850-4cca-b919-51a88345725d", "comment": "Malware payload (Mirai)", "value": "88fb3c1c476207e687f1872c0feccee05ec0fa7a78fe87bb16522b6d833cd965c94bc3b311adcc1637a764e699a7a13b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349896, "uuid": "236a494c-3a12-49f1-9fac-5c4ceb3b1dd9", "value": "T10533E896B9429F16C5D016BBFE1E118E33121FB8E2DB72035D157F203B9BD5A0E2BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349896, "uuid": "47fc05c1-b435-4f13-a438-57815b8db3b3", "value": "1536:O3n/AinH8TWlAfRonHZ6idq18KHEY2EVxOa3x5deG:tq5HMidqi3mU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634349896, "uuid": "c362861b-0bc4-4641-89ec-b78301c3f77d", "value": 53976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634349896, "uuid": "2f068be9-372c-4a30-96ee-e44c300dc60a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349896, "uuid": "05c38eb8-ff3f-4e7b-85ff-8f8d7935b273", "value": "248db6aafaf0d1595c6fdfb2b3e79276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f71ddc-2e65-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634377310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377310, "uuid": "583305b2-6f6d-488c-aa6b-35c44f14d929", "comment": "Malware payload (Mirai)", "value": "652ceabd676b70746491548bc77ea6f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377310, "uuid": "fc1f3aaf-4c7d-4bcc-a2a5-a5b0b20cdee1", "comment": "Malware payload (Mirai)", "value": "ca1e9ad96796792527ad0286916ff59bcb0acb99433adea753d5dad26e327081", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377310, "uuid": "20813e10-f134-4d47-b458-aaaee70ef72e", "comment": "Malware payload (Mirai)", "value": "820d1b5b75ae5174e31a04fde704f01aaf8a1ece", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377310, "uuid": "f62bfec3-4f2f-457a-9fa4-68760219046d", "comment": "Malware payload (Mirai)", "value": "c962d457e0733b6fb025fad40d5e246add7d837396f2a6fa9ba7514871723511b2334b5aa006283f52e5d661944f0798", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377310, "uuid": "be715cbf-ea9d-4e08-92aa-5b3a1d056b09", "value": "T103C33CC7D502C5B3D4020EB212AB66594922BF7B896B59E6F7183CF09F7188A3235FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377310, "uuid": "c6e5e3f0-15d9-4cd4-a68b-6d0b978dd4a8", "value": "3072:8w12waGRCuhuryRcetJ8add9QzTsbzvb7R6g4mKcXeGcgqqi:8w+0cyRcetJ8addQgcg4mKcXdcgqqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634377310, "uuid": "84483d80-7895-46c9-8a95-2fdda31db927", "value": 125257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634377310, "uuid": "67d31934-3cd4-4e0e-911e-a9278092308d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377310, "uuid": "8fdff516-0574-4d85-b3ee-94567d7fc784", "value": "652ceabd676b70746491548bc77ea6f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd725a7-2eb2-11ec-843c-42010a9c0014", "comment": "Malware payload (Matiex)", "timestamp": 1634410574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410574, "uuid": "eb93d6b9-3114-4278-9cf6-d891d97db421", "comment": "Malware payload (Matiex)", "value": "292aee5526ba2e4858d7ea9178878387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410574, "uuid": "9e957201-754b-41f0-a154-79de32ab69ab", "comment": "Malware payload (Matiex)", "value": "cb3a930b00d73a9d5a0313b549a93636eecaf9a4c370e2e9d9ca1b1eaf302eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410574, "uuid": "65a33f60-6a9d-4f5d-a712-e4ab6ddc180b", "comment": "Malware payload (Matiex)", "value": "305c62f106a105f086b3a9ad40a2e706d843a148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410574, "uuid": "e9eec117-9cac-4d98-832d-e07e9b17a7f3", "comment": "Malware payload (Matiex)", "value": "ed4da7009c07a6369901be0505c99f109abb8e8b43ee4c50ce213d547addcb8c3feb04e854f80f82ca7acde2b68604a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410574, "uuid": "088bc2f4-a3d5-46c0-9c14-2f1d0a975b16", "value": "T14105E09C7651BD9FC85BC97689981CB1EB2074A6538BE203B05316BEDE0D69BCF110F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410574, "uuid": "c2f74c25-26af-48c8-99c9-bc49ecef557b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410574, "uuid": "fdbd0593-0abb-4e27-8021-b18a30b006cf", "value": "12288:3Iy45MyvMSaoIiypaGasksDVvW/IGnOO4SA6gPcHLsV32f49wRuESBRh+DUORus:n45BvCjijGRk3aSA6gUH4MfNuZBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634410574, "uuid": "26a10e56-ba4e-48eb-9d0c-70c9779f96c5", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634410574, "uuid": "af94cf5a-e879-43b5-9844-6d1bb1194a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410574, "uuid": "dbb528d2-7b02-4bde-8323-9c82814b358e", "value": "292aee5526ba2e4858d7ea9178878387.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575edf51-2e2b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634352422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352422, "uuid": "5fea597a-3a8d-4685-acc0-7a144e67f2fc", "comment": "Malware payload (Smoke Loader)", "value": "9a112488064fd03d4a259e0f1db9d323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352422, "uuid": "9882c680-084f-4340-a2f1-ed42d81481c0", "comment": "Malware payload (Smoke Loader)", "value": "ccfd37710068b3998537ac325e29555ba9375ebf1230cf90e9dcf133e06bcdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352422, "uuid": "574974f9-7ba1-4a78-b8f8-2570271eb50b", "comment": "Malware payload (Smoke Loader)", "value": "ca15a3ddc76363f69ad3c9123b920a687d94e41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352422, "uuid": "d3f0114a-2719-46ab-9ae2-ae18c7b2cdfa", "comment": "Malware payload (Smoke Loader)", "value": "b61ef54853f618f18952e532e575edf358ed680d22cc21ef1c894d99c242f25bc5556cfb613ae6dbdd32516b75138783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352422, "uuid": "a3db7fa6-66b7-4e8b-a784-854a07045c2b", "value": "T118845934E201F026F4F20475AC6ED3BA69286B30675548EFF3D44E69AAB56C1E234F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352422, "uuid": "72c4dc37-5c52-4bed-9522-069e64ecd81e", "value": "441ea5dabfec8fb454e631fa97f99e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352422, "uuid": "1b859c8b-4862-4f82-8d5a-4b4d64163609", "value": "12288:4zH6GrstMQ1PVNDTrQ8j+xS42uW3o/Pp60VuQ755HWT:4zVrstP1vrQ8ixSpvkPlHHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352422, "uuid": "00fa73c9-fca6-4e57-8cc5-0726776f06bd", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352422, "uuid": "2ed1fc7d-3ce4-4562-819f-e9dcdb65f79a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352422, "uuid": "7d721075-b4e5-45fa-8be5-a16e071e6b4d", "value": "ccfd37710068b3998537ac325e29555ba9375ebf1230cf90e9dcf133e06bcdf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bcb234-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634352985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352985, "uuid": "a97edaf2-cd81-46d5-865b-dcccecf51aae", "comment": "Malware payload (RedLineStealer)", "value": "36c2d74bceab2c50a296b5f5e46bdd50", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352985, "uuid": "90b46bc0-564d-40c3-9f10-52404fb0b742", "comment": "Malware payload (RedLineStealer)", "value": "cd22c1aabcafc40bf81d42b42e625e49eff9e0f928fa961e43573e1eb45ace18", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352985, "uuid": "03d4c275-e8d1-4df0-88a6-8bb64543ce67", "comment": "Malware payload (RedLineStealer)", "value": "b163c905cacce0fee43bb55b00c7c0a410e1c676", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352985, "uuid": "84237917-596a-42d8-9ad0-3342fd9b0581", "comment": "Malware payload (RedLineStealer)", "value": "1134e3ee39f5fcdf9548571f7399bbd1403c38c65f524e97a1cfd152fae9b3c2605faa6990474941b12c5f3652097b56", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352985, "uuid": "5ec338fd-ebd1-479f-9450-e5efd517940b", "value": "T199A4A59D765072DFC85BC472CAA81CB4FA607C7B930B9207A0172AEDA91D997CF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352985, "uuid": "70af8167-731b-46ca-a738-41dfb7d359cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352985, "uuid": "65c05be2-0d8b-4944-9ba8-c18fa8efc7af", "value": "12288:DooLY/n57gQhzUz7fZTnYr2HoFT2da2Xh90YKKIfJ6Mzb7QSJzHIw2Z:DooLon57xzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352985, "uuid": "3d0cce36-f5cd-4f49-941d-245da879316c", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352985, "uuid": "edd89d6f-7d5e-43f3-9060-65cb364e5917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352985, "uuid": "c466c6f5-856c-4658-97e2-77966e5f104d", "value": "Gyshubilihy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6cf710-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634353102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353102, "uuid": "be60b136-6a64-44e3-91d3-ef738f8815ec", "comment": "Malware payload", "value": "dc534760d1110201433d670e90ac2ed2", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353102, "uuid": "78cd2167-0c74-4fc2-826a-bd8e1ea18ee9", "comment": "Malware payload", "value": "d097ca2583425f648592138b57562334c0b83d3179634fd43a0b611bdf720122", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353102, "uuid": "0fd4fa17-70af-4223-9353-641b56dede42", "comment": "Malware payload", "value": "4ece22c0a4bde2a2f2936d87d9d6acb5668c3c78", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353102, "uuid": "16c143e6-bcce-463c-ae19-961b4d84aa19", "comment": "Malware payload", "value": "71c34520e081c7cb73fd5ecef9e999c45b86638929094c1e7d19a6167ce2c56c593ccd80a17b80691efe00fb8b17df89", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353102, "uuid": "768d1482-881d-4810-b6e6-b1094dd3db50", "value": "T1EC936B10B5E1C471F17319352976DAE15A2EF9204F259EEB379C026E0F340D0AA3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353102, "uuid": "0f0a3b68-29cf-46bf-9c0f-1b1d100a87b1", "value": "b4f437d48e25c7b06031cb97b5e20cd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353102, "uuid": "e2b4f061-bfe4-4a68-b605-217204608175", "value": "1536:J7MGuViupm7ir2Ooe+JciT1GdeYH2JaGdVtcrYxam5+s8jcdGhWfM3IP:J7jYZoBPTcYYH2cG6r4J7cWU3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634353102, "uuid": "2ba8c1fc-8310-43ef-9417-0f4b83f3288f", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634353102, "uuid": "0b11b32e-00db-4bbe-9549-c1dc60967478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353102, "uuid": "76fcca83-fca0-4b24-9b4b-c0beb625bc8e", "value": "UfZQclP1sP8dkdmyrez2O3E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0b1a6e-2ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634403003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403003, "uuid": "e7fcb815-3725-4900-b4ea-fd00494077f8", "comment": "Malware payload (Mirai)", "value": "dbdea3d343437a14a66f07c3ebb22352", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403003, "uuid": "2e265519-6daa-466b-93da-a97e7717ea47", "comment": "Malware payload (Mirai)", "value": "d0b77673803c254d34760b3c05575bab548df662680c825eb804e543903acfb8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403003, "uuid": "a9f7e7bf-323f-4755-b45f-d7f33576aa77", "comment": "Malware payload (Mirai)", "value": "8e5dccde05d5aa1f65168f317110bb416b31e359", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403003, "uuid": "23a95757-7781-4ba5-96ba-a02dbad4b769", "comment": "Malware payload (Mirai)", "value": "6880ccc9b9bda5f3190a40984c04ecbd2933eb623d15c7fafc87ecd01c3747dd711525d9c7f5470536828d4de3c3e1c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403003, "uuid": "114a8cd5-580e-4ca2-8760-ecae874a308a", "value": "T1E3E34D56EA818E13C4D527BAB9AF01893332A75493DB730689185FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403003, "uuid": "39f87be9-376a-44f0-969e-2d9c6779bc06", "value": "3072:MgxYi2gojQeTWKrsRdx4KD+w/6HCPK0d27u+bn5mx617Xnu/IM/9wBqh:HxYi2gojvTWK4R4KJZ27u+bnExOXnIIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634403003, "uuid": "335fdeb8-f4d0-4ed3-befe-76191e38b0d7", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634403003, "uuid": "740baafc-3dd3-414e-ac9f-52de6b247e20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403003, "uuid": "e30fc6d2-f02b-4bbe-9b47-6113c771a16d", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4336e0b3-2e8c-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634394049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394049, "uuid": "3c8593c1-46ce-4aca-9b91-fd59b715d972", "comment": "Malware payload (RemcosRAT)", "value": "f1a4ef4fbce540f67061dbe829ceb5d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394049, "uuid": "04434337-46ad-4062-ad8d-378f7583dc93", "comment": "Malware payload (RemcosRAT)", "value": "d338f6946cd36d7d216945bf63e07ed0cda1983a2296b6f4f1a8b4e9a892346a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394049, "uuid": "f498383c-df45-4f22-99c5-c1fff4d23185", "comment": "Malware payload (RemcosRAT)", "value": "44fcab47b0ccc49ff0ede26322abcf977ab9e204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394049, "uuid": "3fd3ab68-99b8-4d61-b333-ca787979df3c", "comment": "Malware payload (RemcosRAT)", "value": "448150196409b16724720ee8668f25b226a31c566c3813f87c0301f70faac4b947c336857295bc8ba3dd9c7e2135c14b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394049, "uuid": "565d5ffc-6cb0-4248-bcda-36d123c50d77", "value": "T10E55BE12B781EAD9D15A0FBAC91B0CF853F08E1B5375F35F26D13AD8592070EA41F89A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394049, "uuid": "84487715-ff30-4f52-838e-4aaefbcdddf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394049, "uuid": "d5785775-34d5-45d1-a09b-41ddeba873be", "value": "24576:aWOUJmUty0V17eIKZh7UgwcEU0JYxi4WMq:aWlJmCvhiw1HYxi9Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394049, "uuid": "16cd5ae0-b744-4b9c-b531-1072c46296bc", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394049, "uuid": "327db863-9eef-41d2-b697-d5c5c3fbc25d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394049, "uuid": "c9d6d9cb-0c52-479c-b818-c532c8733bad", "value": "Order Quotation Request_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74587ba-2e87-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392204, "uuid": "77762cbb-a398-4359-aaa0-801c71d27f14", "comment": "Malware payload (Mirai)", "value": "e857eba964a3de3c443606b8072d9ff9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392204, "uuid": "0b067c3c-c144-4f31-9835-3f19a5934de9", "comment": "Malware payload (Mirai)", "value": "d46bbbd0ad2b8145eca48803af594d809e8094d8992c4bba4c5e90da22ec8048", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392204, "uuid": "2f33cb3a-87fc-4957-9baf-b8c176223cb4", "comment": "Malware payload (Mirai)", "value": "b79e10ee3b9f3c83b5d68dc18bb260a3479c6ab8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392204, "uuid": "ca8521eb-3536-4e23-8b48-44135554ca7e", "comment": "Malware payload (Mirai)", "value": "3510d3a128bc15c290c7efd9a88f2486ce832e674f097e0d7ee532b06cf6d3597446efeb82ab3f161cc059df9952849d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392204, "uuid": "d9a320fc-ee84-4488-bcc6-7d508d0234e1", "value": "T12433F107E70B15E1D650DC3F867D474B3309277DA5CE30D5722203A87E87A4B69F9A2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392204, "uuid": "1fdc09ad-a5e5-4cd4-ae18-1848c73cc679", "value": "768:+gGIN3+Vp7H0YXwifrGrBpCHV1ZOkhX71Eqiksxuq3UIo3FS03kmT6qMzb1uU87D:TRN32DcaarwphdHOBbq6lb47g082t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392204, "uuid": "15aed73d-6cf5-4651-bd9a-9e07095edbec", "value": 51084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392204, "uuid": "ae1ca41a-ce69-4186-bc78-0afe77f542be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392204, "uuid": "03dd9c17-4418-4fe7-a35b-b2cdbfc97557", "value": "apep.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c836ba12-2edb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634428203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428203, "uuid": "fb8492d3-4b54-483e-b9ce-bb3063622ad8", "comment": "Malware payload (Mirai)", "value": "f90421c8ae5dcc342114dc446c72899c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428203, "uuid": "a9d6ff4e-5448-4695-913c-7e7f2ede0ede", "comment": "Malware payload (Mirai)", "value": "d4ff87ac8d8a3c1fc56e14cfd06c16171831112967594c1e5d6a94d332fda0fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428203, "uuid": "0d82dce9-3b81-48ce-982d-911382f7c858", "comment": "Malware payload (Mirai)", "value": "90a71daf5dc2226394dd7c2d1382c7264c720fde", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634428203, "uuid": "e2234e6c-27f5-4425-a0a4-3e89705fd256", "comment": "Malware payload (Mirai)", "value": "c97a3a9c11876cc74e0f4c01533ba6acaaeb27e1c400e044e60148bef134fc02c2f44b88d29ce19bb0f2ebae2164f766", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428203, "uuid": "59834f48-18ea-4cbb-b47b-a665fc08d643", "value": "T11033F15583952873DC36083696748503FEA86BDFF07E709A36E49398F4819C01E7299B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428203, "uuid": "b2fce0a5-81df-475d-a4dc-554b1b0d0cc7", "value": "768:x95NSWIzoC3rbGmK5WZe04eAT8N2lfj9DXhiJ28ZaBtS9q3UELu+C1iPUL5CMmAV:o3rSmM3TdxlhiJjZaBtHLuYPUVCWdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634428203, "uuid": "2cbe76ec-6723-403a-8520-fb7780510d4f", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634428203, "uuid": "720ce979-eb6c-4e6f-b09a-89c9fbe1da62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634428203, "uuid": "7817dffe-60dd-48d0-b5a7-8663b70668a1", "value": "dark.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ecedd8-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634350514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350514, "uuid": "a641ea3e-39b0-43bc-b232-ab6c08fd9c39", "comment": "Malware payload (Gafgyt)", "value": "1028bdfb74beff72d0fff09e3549b5e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350514, "uuid": "8220cd0a-ebc7-4a34-8d9d-0f839c0ae62c", "comment": "Malware payload (Gafgyt)", "value": "d6919fae25fb5691e7a0065e485d64c2946a8524ec1566e13f11580ae8d51074", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350514, "uuid": "5f985b14-9a1e-473b-bf51-2aabbef601d7", "comment": "Malware payload (Gafgyt)", "value": "57a2d66d9d4c1e7fece95e47f0d4c2a00b1b3aca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350514, "uuid": "93c44476-2610-4688-934a-f49fd2059ccf", "comment": "Malware payload (Gafgyt)", "value": "f45e874157114f0106ce6e70b0feabbae1c6332a3569b07a87429d9ea0aa3811124716957c92fce373696979bb87cf30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350514, "uuid": "a02bf6d7-415c-4c88-a90b-0c3116a69469", "value": "T1C1F33905E6808B57C2E2277AEB8F424D33339B94A3D733155938ABF43FC2B991E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350514, "uuid": "c4f60822-30dc-4ade-8106-45b9d04e4e1d", "value": "3072:SQcuJlaDDpWXnVjeW0M5ZfdnTpAM/90F1upmPwfBxKQfdl:SNolaDDpWXVaM5RdnT2M/99mPwfBxxf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350514, "uuid": "64dd8dc6-5006-439a-945c-78d9a0a2739d", "value": 162914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350514, "uuid": "69b3703c-cb1b-4812-b7be-0a6237fe1bbb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350514, "uuid": "4b86da9e-2034-4a7e-a2ac-46f6d0dae1ae", "value": "1028bdfb74beff72d0fff09e3549b5e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061cf26a-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634380633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380633, "uuid": "192fde81-fff6-42f2-80f0-06f29ab23263", "comment": "Malware payload (Mirai)", "value": "8feaee0edbc6f04bf60a3abc443e128e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380633, "uuid": "aae551fa-511c-4a0a-a1f6-e6f0f72d3176", "comment": "Malware payload (Mirai)", "value": "d74f9dd72145fb1a3d8546d88173f8642b0d1a1a20f1dc0c6b368738dc7a1439", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380633, "uuid": "cc42c1e8-ffe4-4c8d-b395-2e0467fff714", "comment": "Malware payload (Mirai)", "value": "afb9068bd46967125be839a2b639bbe8ccbffa55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380633, "uuid": "820da2cf-11de-4dbb-9c6c-c8b837bdd408", "comment": "Malware payload (Mirai)", "value": "9c6e511259990eed084dcdda9b612be933dab8ebedfa1a24e660d81ab90907b74ad2abfc3289f6f849883c463c5c4874", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380633, "uuid": "8dbff6fb-88d6-47cc-85c2-8a9388d05eb5", "value": "T1B4637209BF614FF7ECAFDC374AE92745208C681A22987B397934D818F24B25B15E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380633, "uuid": "6cab2991-edcf-405b-90db-e9bc6be6af4f", "value": "1536:fUAYr/8Xm8e4JXF+hmyyetEiDteZeRpN:fRYr/8Xm89FOte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380633, "uuid": "f861ef74-c6d0-4290-a027-3d80de5d9d1a", "value": 71664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380633, "uuid": "e9495e35-0aad-46cd-a4da-5d012e59265d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380633, "uuid": "f2e78348-94d5-47d6-a552-9041d5ff58dd", "value": "8feaee0edbc6f04bf60a3abc443e128e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdc5bfa-2eab-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634407331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407331, "uuid": "d28bfc90-93cc-4626-b639-bd489f4bb016", "comment": "Malware payload", "value": "807f55cee679ba76724aee80756a0c4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407331, "uuid": "4746f4c1-75df-4505-a012-9a83b9b78a32", "comment": "Malware payload", "value": "d788b085cc98c274abd24c4ac8d00f870297dc4f5b68684af8a5c328cc50beb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407331, "uuid": "e966326b-84b2-4fa2-b8ea-666aa7c76073", "comment": "Malware payload", "value": "7014d9c67d8a44a8eff67551786b74f74dfa47e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634407331, "uuid": "80e6545e-439c-4634-b77f-0c94cca47383", "comment": "Malware payload", "value": "821964d0173ed5eecba3f37702707f1c2c1b3f8ff9d1df8b190544cdfd35bfa03bb351bb796607d049ccb7d2d95fa4fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407331, "uuid": "8555f80d-c645-4236-9514-a061d8eb9a1c", "value": "T143658E4AA3A901ECD0ABD278CA529607E7B17C1107309BEF13D55B5A1F23BE15E7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407331, "uuid": "0c8e37d7-ba16-443c-8956-20005fd1bb07", "value": "0e0b1327b851d652046461e0a8be7593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407331, "uuid": "964dfcd8-5ebf-4f65-8759-9d8f00d2521f", "value": "24576:ur0Y0b3wTBY0zc3OHmIOss9/DQTBlFadP6WNltPSQv:ub6gT20iOHmIPWDQll86Ytfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634407331, "uuid": "e9e1dd90-3539-4aa2-995f-8e7f64a4ec50", "value": 1422336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634407331, "uuid": "5bf69cf7-2709-4e86-969e-95315ada03b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634407331, "uuid": "adaea7c2-3733-4d1b-8ddb-1826a011f6ba", "value": "807f55cee679ba76724aee80756a0c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ce43b9-2ea4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634404447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634404447, "uuid": "1036c589-4972-44a5-874d-a07129953e82", "comment": "Malware payload", "value": "bf704f182bbb859d29f5fad29017fc7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634404447, "uuid": "7b23c2fe-75df-40eb-aac7-c7b697d74ad9", "comment": "Malware payload", "value": "d965344c145a82ea6fcb32c42f683a15e27914bd9f243cb55782c367eeb17d19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634404447, "uuid": "a873dd6e-9e90-42ff-9597-4fd28f97f277", "comment": "Malware payload", "value": "16ac48c6e870bcb9a1932669e48c6037a4f45126", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634404447, "uuid": "6c640a4f-6f8e-41cc-8b76-33863d1b3e4d", "comment": "Malware payload", "value": "fed9d4440ec8f06ce5a3bcd139122d031a4e8cd6eb46a875cd55dbfe4bcb6ece298755e1cc6067c24dc563703075a89f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634404447, "uuid": "9e1a888c-d81d-4495-9452-38c1397adba9", "value": "T1F0A3384172D18875F4B31E322871D9A49E2EFD640F659EAF6398022F0F385D09A35EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634404447, "uuid": "009eaf16-d96e-4904-9377-c2d6668eb4b3", "value": "2b20eeb6148aabd0fc53f3237cfb9a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634404447, "uuid": "951cae77-8bdc-4a8e-917c-2e746b50a361", "value": "1536:K+Th2NTQCqdNeTOG/Yyz17QmSYYIKgD3DDO7y8VNCYX/isWcgIcdnws8nBs0HWfN:K+ETqPatQy57QGYFq3Dy7yKCS6JnNwWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634404447, "uuid": "9f315e96-ffc8-4adf-a022-89213bf3ef33", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634404447, "uuid": "3dbd78c6-63c9-4238-8854-b0e7addce121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634404447, "uuid": "0a662725-ba5f-4445-b0bd-b2077fc8da45", "value": "bf704f182bbb859d29f5fad29017fc7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5554b535-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392362, "uuid": "0e5b4ffb-842f-4305-84ef-b999a8d731c7", "comment": "Malware payload (Mirai)", "value": "4e2fd332082c82152f10123cf8162fc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392362, "uuid": "a9564055-1ded-4efc-b4bb-e7c17fd892e7", "comment": "Malware payload (Mirai)", "value": "da5b21ebaa6857136421a549dcc38229a015fe8dc05b8306e07edfd42d33e223", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392362, "uuid": "238ca4a7-f076-4a22-a723-c5c901bd86fc", "comment": "Malware payload (Mirai)", "value": "a771d85a7a89f4d4c69c81220ae3854e9ff707cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392362, "uuid": "d3f6f2de-e94c-4a7e-93a9-e7c9e689f6c9", "comment": "Malware payload (Mirai)", "value": "3be2346bc3f5c56c84e6f13bf136841da837316510b0fc3a39e8f16084d6ef0c480a5081fd9c9bebba761fe300da77a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392362, "uuid": "ba5b83ff-4db3-4ddf-8371-43bd3ba5349b", "value": "T17E433AD6F400AE7CFD5BEA7A84124A0AF571B25149630F77B363BC93AC320A5593AD06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392362, "uuid": "690ce540-63d3-4923-94c3-1e6ba194930a", "value": "1536:oL3iOkim7GsSHR+nuVXwJeMqY6ty8Sn2f80:CorSHcnSXwJvpAS2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392362, "uuid": "22e3de26-729d-40b2-9827-50a3579a9164", "value": 59292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392362, "uuid": "9e59527b-1333-44ef-bbdf-d9489861134a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392362, "uuid": "2c610c71-da6b-4374-bb3b-f2b103f0c073", "value": "4e2fd332082c82152f10123cf8162fc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8fc2e2-2e8c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634394256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394256, "uuid": "855044f2-d10b-40c2-9054-934b10b613ff", "comment": "Malware payload", "value": "7dd148d2b77f2fa90e1fd820c3805050", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394256, "uuid": "aca08fd6-f89b-4a3d-b55d-6278ecff50ab", "comment": "Malware payload", "value": "da713b02c4b037782aab8b4e43ca30d733ef1bf17a5917dad232abc224adadd6", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394256, "uuid": "7941b07a-5f0e-4027-b919-da6734eaa3c5", "comment": "Malware payload", "value": "856b871ca2eb2652c18b94cf731aa284cfc4fd34", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394256, "uuid": "59cb10f5-77cc-4f5a-96ba-668324df3b97", "comment": "Malware payload", "value": "304b4dfa795bbecd2a89a3da63be31a404fea757e7bd74c4f3fa5dce30a3fe5a9d68138995cab4f3b7f6d35787dd47f3", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394256, "uuid": "3e0b7699-428d-4a09-aab6-ae2d3d2f9dea", "value": "T146663335B8F6E539E0E16AB1561A3FE9E3778E744A70C4673B8C270E7B3E149C521260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394256, "uuid": "a69ef76b-e106-4a60-a486-ab4b1b582e44", "value": "98304:G1ODuO5e1YItKzEf4r+HxJa9OQl9aNP30bF8254VhQnYPmboncKPiR/6:G1OnmhSEf4r+H3akOaNPO82ijQYPalN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394256, "uuid": "89ab7ed8-05f0-4b56-be13-3381f6488279", "value": 6883328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394256, "uuid": "63d83fa1-3c8d-4806-8d99-95849def7a0c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394256, "uuid": "16fff2db-4fb4-4358-bac4-b852e5d42539", "value": "YouTube_Adblocker-[619915_UuqWvy].iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c88c46-2e89-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634393037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393037, "uuid": "89c0b420-8fe1-42be-9e6e-59d4440ee5bd", "comment": "Malware payload", "value": "4a15cf91524eef1b6061a9733735e2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393037, "uuid": "a396fa90-a067-4e2b-897e-3a274d27e3bf", "comment": "Malware payload", "value": "db7681db479489fe2319d8eb00090749b4a56cb97cbe3c0f867a0f7a66a37f9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393037, "uuid": "3a4d82ca-4d88-40d0-8886-510ccb561187", "comment": "Malware payload", "value": "b7bc26891ca7d215af1e0336420ef1d2c15ddd5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393037, "uuid": "c2e10485-e906-49ab-8d6b-26f623ed4abe", "comment": "Malware payload", "value": "6cc34f4090d83286dcf8fe2ef60c768ae7a9ce429a69f25389e4d46838d77f0881e86e2980bceeea67e3c6bd57f76115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393037, "uuid": "6160faff-ceb3-4aa3-af10-f1f84f9de39c", "value": "T1628351243EFB8029F173BF7A5BE47597DE6EBA233B0B94591091034A4613E81DD9063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393037, "uuid": "48f1904f-0453-4f49-ae07-fd340785716c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393037, "uuid": "a8c22093-5273-4331-a319-6ab089dbe6c9", "value": "1536:to2i/5jKp8r9SPkrJRXuFwzQcegX5HKKSEiz/z9ZPkUiY0vf9EdRbLNWV:toZ5jKp8r9S89RXAm35HKKvI7PtiYW6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393037, "uuid": "77ef6ecb-05e8-47ff-b8fb-ee4a37798b70", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393037, "uuid": "70f49326-cdac-405a-a82d-eaec0462f710", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393037, "uuid": "c9aaa9c3-75c7-472b-8890-cc8b3de53d94", "value": "War.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ae5f47-2e48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634365014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365014, "uuid": "3a2bf101-fccc-43c7-a99a-d3000c48e8ff", "comment": "Malware payload (Mirai)", "value": "6c516ac4c9863a0c0fa5c5d9db99121d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365014, "uuid": "ae1ecd03-261c-4cbd-b429-aa64ae07d28f", "comment": "Malware payload (Mirai)", "value": "dd1d220252175b5dc60c42ba3b8b16b5720f58ca3d20ee766a2b2a57d9637b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365014, "uuid": "91d5b310-9e03-4f85-ba9a-11bd12bbc272", "comment": "Malware payload (Mirai)", "value": "63e2452b965e10d73a622c0e88ab08b66c496484", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634365014, "uuid": "5dec6661-3ed2-4166-8757-5e41103b1c15", "comment": "Malware payload (Mirai)", "value": "a4ee7e55e30298157e165486f6997a050bd124899ca3d9abc30395988406eea6ad78947a43ef974c4f02cae2169c9ec0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365014, "uuid": "67a17c66-d0b3-4377-a747-a8e822ae9d27", "value": "T163E2E04E54A83CAAEECE483D12DD0468ED8B6956031DDFC9236244C0EA6F85DE5EC47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365014, "uuid": "af853925-92e8-4b17-af9b-36f5f94747dd", "value": "384:f3fpCLrsjHIX69URc+hmnulY1qHprFKt6zNJpRwD9MH+DuviJCyhya3dRWGVCz0C:vfpWcehzJFYKn7gMHRawa3rW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634365014, "uuid": "0ce90c12-313c-4b05-b34a-2a7e21c602f8", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634365014, "uuid": "d6078795-5b33-4963-8df9-e7fdeefea673", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634365014, "uuid": "066b8d69-70f9-4271-acc7-ecad8f1a35eb", "value": "6c516ac4c9863a0c0fa5c5d9db99121d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72175da3-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634376948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376948, "uuid": "b3fa6e83-f951-4a88-861d-6abc946049ab", "comment": "Malware payload (Gafgyt)", "value": "e456d793be632d1f0c38fd1b12da11ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376948, "uuid": "bb56ec1f-7488-49b6-bd08-f61548c51c91", "comment": "Malware payload (Gafgyt)", "value": "ddbacfe88dacbded826537e5dd297ef5b9e57707e8eb22fba4ef6af9d5174cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376948, "uuid": "bfa5e6b6-2615-4099-b844-43e227a1568e", "comment": "Malware payload (Gafgyt)", "value": "a334a68cd70bbf75cb52a4e6e73152f841d6a1e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376948, "uuid": "1b930466-709e-4323-a6d1-a0f0b3dfed43", "comment": "Malware payload (Gafgyt)", "value": "e73b0283b0e8300eda9920199395c8ffa1b2f73430846d198510a534ee0cae8b53c76c3f89f7e101366a95fdd9f1f86e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376948, "uuid": "29a6028d-1a02-476e-a0ae-eb140394b8fa", "value": "T12DD30857F801CE62F4099A7201D75B11B671FFB70E8321B2A25B3966AE322963477FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376948, "uuid": "9df05220-9e21-42d2-a5e9-34aeb3095dc8", "value": "3072:vltcot9aDRdCwomUDiyyS6/GRZgq329UwHfyhmM7KQiVGngBSI:vUUmRdCwomhyy5/GRZgqifsmM7KQignK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376948, "uuid": "e129e8c9-ef14-4f8c-b96f-0f3cc7eafe82", "value": 139393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376948, "uuid": "8c3f16ed-ed2b-42bb-9452-6fb176c7a833", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376948, "uuid": "6f7675c9-813e-428c-b4d5-924dc4dcf07c", "value": "e456d793be632d1f0c38fd1b12da11ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfb95f5-2e26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634350474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350474, "uuid": "0ee86ac2-ba63-4c5b-9a6d-d684e007adde", "comment": "Malware payload (Mirai)", "value": "b00dca7456327227beed7a3c22facdbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350474, "uuid": "e3337f54-708b-43d1-a8f4-325fdd82cf7e", "comment": "Malware payload (Mirai)", "value": "ddd0d2b210d35927b2eb7e858d302622a533131df5c3e004c5a0dfd4ba435f91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350474, "uuid": "9cfad9ff-c40e-4083-9f59-87c1ba729657", "comment": "Malware payload (Mirai)", "value": "1d89ebcb6037d3b901afaee97941a8d71fd07118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634350474, "uuid": "9e408c46-7533-46ba-9cda-febfaa6d4767", "comment": "Malware payload (Mirai)", "value": "a36b23f17b25279df8d354593ffdd522e3419e5920abd4e54520d505be1d6abcd2a0149a8f77a6ca645bf67df746b602", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350474, "uuid": "44e212ba-9c6a-452a-9eea-3568c81e1fa2", "value": "T19293406B7E209F29F75C573106FBAC28834A13A726E5E64AD18FD6005E3132D1C1FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350474, "uuid": "2b7f6106-9137-4086-b722-2fa649eb740f", "value": "1536:xQutcVXS4EgUa6M97KiZHvXJlvgrUw8tez5+dhr7J2rXfEFb1l1Wqtpw/v:6bk2UYmiZHvXJlvgrUNhdhr7UfEFb1lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634350474, "uuid": "950382da-3e92-4ea2-87de-adf4fd43f61f", "value": 92168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634350474, "uuid": "ee749caf-2215-450d-89fe-71be91f992da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634350474, "uuid": "b10f3fb1-bca9-47bd-ab21-11f8ce45883c", "value": "b00dca7456327227beed7a3c22facdbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31546e2f-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634380276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380276, "uuid": "ee6fa753-fe89-45be-b12f-d3a7f856267c", "comment": "Malware payload (Mirai)", "value": "ed3a45378e764208499bb7e8ddb73cd8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380276, "uuid": "ee40fc13-fe5d-46c2-bcfc-573e3380f55c", "comment": "Malware payload (Mirai)", "value": "dfd186ea546ad2adad078a93bc8af287ed4b80aff22e069e729144144f76b302", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380276, "uuid": "908bcccb-742c-4b40-8e3c-f72d4bcfe720", "comment": "Malware payload (Mirai)", "value": "8111a5a62e409423598731a0c0581bd9fe9ebde0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380276, "uuid": "c8809b14-f2a1-4fc2-9617-8417bbda3e82", "comment": "Malware payload (Mirai)", "value": "3b9b1cc696dcb080f2980bb1b7336ff7f5cc8258eeb53191ede644601ebdf93a2429310e27cb56f40018e723109c13ec", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380276, "uuid": "e16d0fff-e1fe-45ff-ad5b-8d7cdeff273e", "value": "T123B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380276, "uuid": "ace5e7a7-934c-408b-bdc3-64a07b2316d0", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAt+TRCm7FnVqfJXFWbNb:T9a2aLqkrMgsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380276, "uuid": "37bb498b-ca04-42f9-8ba1-591434a66333", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380276, "uuid": "359f1f21-a5b9-4469-88bf-1022e983e53a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380276, "uuid": "6b879855-4575-4292-a0e7-962071dd7d7c", "value": "ed3a45378e764208499bb7e8ddb73cd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de6b203-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634376941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376941, "uuid": "ae082ce2-27a2-4871-b291-86f01147ce90", "comment": "Malware payload (Gafgyt)", "value": "2619632872a7acd190bc2a02faedcce1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376941, "uuid": "48639dc8-82e6-4639-888c-ec30aa35d7ae", "comment": "Malware payload (Gafgyt)", "value": "e2c94cfbf6e7e6f86ae46ed68809626d81f3e87846ab23de82706a0c088097e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376941, "uuid": "38fe770d-379a-42b4-982c-e5b7b5aac652", "comment": "Malware payload (Gafgyt)", "value": "b259c40ff9f016baca07df420e50ada3a7c64f8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376941, "uuid": "497c4c3a-7a85-4e06-9d95-fd6388054da4", "comment": "Malware payload (Gafgyt)", "value": "3f8b37e60897a81c0e7d6f7ecc0052d8269d096c116090d6a30516443bef1cc32abef20b2ed880abae9f5024c8e09780", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376941, "uuid": "6d876076-22dc-4dfa-8a0d-38f4b74f1fb5", "value": "T153C32AC3A540C5B3D00209B222AB67054632FFBF499B69A2F7593DF49F3058A7236ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376941, "uuid": "69df07f4-a848-4cf3-b5a9-9045237233a3", "value": "3072:kOdZ5l8YKgfhCsBiHetJ8add9QzTsQvzUYgt4mKcXeGcgqqi:nl8eEYiHetJ8addQXQt4mKcXdcgqqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376941, "uuid": "b903e0a4-d9fd-479a-9cb8-95ad66e232c8", "value": 121161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376941, "uuid": "67965f2c-81d9-4f19-a4b5-0e6c101e2fb6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376941, "uuid": "a7aaace0-bdb9-430d-8cf1-8cfc09114084", "value": "2619632872a7acd190bc2a02faedcce1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2024f8fb-2e8e-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1634394850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394850, "uuid": "83ba2d17-8382-4c73-958f-467d7506a899", "comment": "Malware payload (CryptBot)", "value": "bfd38964ce5ed7eb0298112762d73661", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394850, "uuid": "7c0bdb33-d446-485e-9d84-dea760be7cc3", "comment": "Malware payload (CryptBot)", "value": "e3e6b0c7c76f1e07644749b4666f7c24bb9f061a9b9d0413623281d141cfa32f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394850, "uuid": "eb9a3539-5c94-42b4-9b2f-f26c6f7d4b6d", "comment": "Malware payload (CryptBot)", "value": "f44f6c31834a5e615b35a79e34c8396f31a440d3", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394850, "uuid": "9a9b6fc7-25de-4fdb-9d34-7ae62d0cbb31", "comment": "Malware payload (CryptBot)", "value": "388b31436eae8e4d0587589605e78a8d0f6ad0f78c03d4ae1a023f67dc7a9d3df907a248119b4fafd456161fbd04fc8c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394850, "uuid": "3ec2ec02-d235-4752-a95a-419a5f932718", "value": "T18C84BF10B7A0C035F5F722F449B693B8A63EBEA1A73890CF52D515EA56346E1EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394850, "uuid": "40b79c87-40cb-4963-8574-49ad5fe63cd2", "value": "baf5c2110fa8a268441421686d4e3331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394850, "uuid": "1aa9f616-4abc-4460-a866-c0fb80f00bf1", "value": "6144:YtojtTr+jbe26iPrJ0gDn2ykShB9uh1NeCx5CmkxIGgz2na6Ja:YtojxK3SQ0jS8LNeCx5PGgz2ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394850, "uuid": "af52a02d-7b11-45e4-998d-749ba7406015", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394850, "uuid": "f728b38a-2102-47ef-b247-b4f3bc62ad29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394850, "uuid": "c40f6a6b-6f52-4abd-8e14-7368733b4d13", "value": "bfd38964ce5ed7eb0298112762d73661.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6586a7-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380645, "uuid": "2b1a353f-6535-420a-b665-e458465031c1", "comment": "Malware payload (Gafgyt)", "value": "aa4cb8c647a135b91fc622d043dba9ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380645, "uuid": "f9755614-9c87-4a6c-a1b5-7813ab9a94d1", "comment": "Malware payload (Gafgyt)", "value": "e418f78041d9913b3bb26f4c836f2fa6d668fad579259a938794deea2b312a45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380645, "uuid": "b9d7ab8f-3577-4e3a-ba6d-4672561157ad", "comment": "Malware payload (Gafgyt)", "value": "e30d564f626823ea8e4bca4604cb2c51233be4c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380645, "uuid": "7a377f23-251e-4d41-8182-c27722e55171", "comment": "Malware payload (Gafgyt)", "value": "2a486a3ecff1a31751f10a14087e2992add49a75c97d3dca39ff6fabb94d84333d90f70913895bc0a18e42b8e45ceee4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380645, "uuid": "b92a46a7-a42b-4afc-b855-5ee1201374f2", "value": "T142B32801D5508B27C2D2277AB79F825D33232BA897DB33165A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380645, "uuid": "5c9c664c-4b58-4c6e-8c32-dc6d0f3968b7", "value": "3072:wdA0a++h8tZ2hWJloxfDq9jBy/bmTQOWsXAOn:wy0a++h8NoxfDqgbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380645, "uuid": "3ff5c287-df1d-4b79-9529-64c7f3f5503e", "value": 111528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380645, "uuid": "a50de956-30a8-443c-8a62-7859367d33c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380645, "uuid": "5ae6bb84-7cbf-4fae-82d1-09e84523a68b", "value": "aa4cb8c647a135b91fc622d043dba9ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a2a392-2e66-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634377684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377684, "uuid": "f05653f7-70e8-4426-9223-2efb148282bd", "comment": "Malware payload", "value": "ddc5b2a70d9d35836656e29076df2e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377684, "uuid": "a04c0755-d8f4-458f-bb05-9b66dc586b41", "comment": "Malware payload", "value": "e480bf6d32cedaa222380bceb88e4cd53ae6fac3d247afe77306dd7a0ec73139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377684, "uuid": "f7ea061a-5696-4b81-84e3-0ec1fdaa3ec0", "comment": "Malware payload", "value": "c2ca58d923e75fdea671464d1fb6cc936885ed1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634377684, "uuid": "43aa4059-ecb0-4760-9a45-f768f65c0778", "comment": "Malware payload", "value": "3e9bfe2b160a8525c1c9f9fc53307e32e255ac929c01be85053553b5faeb53a2e190701710c7e575d8a15cde0a1c0e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377684, "uuid": "182c15d5-2d05-440f-96d9-ef579e7f8567", "value": "T18AF53351A93D7FB0D4FC1BB3CD19707C58C25E9A2B6869509A0FEDC2F91A2C760A5F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377684, "uuid": "5ebca5fb-4be5-49d7-b804-6bb033cc859c", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377684, "uuid": "762bd5ce-f171-4944-8520-648fb2dbd937", "value": "98304:a1s8G1FoX2UxY6vjp3t6hxKMuMfk84yYg3:gs8EoN267b6XKFMfwbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634377684, "uuid": "fdec4c0c-2d2e-4ae0-b81d-291f93516d47", "value": 3495936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634377684, "uuid": "6c1639ea-7535-428c-9f53-7ca4ac62e531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634377684, "uuid": "67a992dd-9e06-4d79-9e29-09c37163acc9", "value": "ddc5b2a70d9d35836656e29076df2e6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf42f36-2e6f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634381530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381530, "uuid": "e8d6d26f-42f9-4d1b-b162-043ea05094a2", "comment": "Malware payload (RedLineStealer)", "value": "ddc216e1cbffd1e3e2eeb6dd42f1fc16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381530, "uuid": "82204696-20b6-4c0a-8a18-7f00b4186e78", "comment": "Malware payload (RedLineStealer)", "value": "e5c7a8e3c41afa656fe8a0db72a99f86f93aa4085dd1860aa1dd67099ac228aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381530, "uuid": "802d34a1-f023-4f15-a3d5-7736db5ad644", "comment": "Malware payload (RedLineStealer)", "value": "a353d3ab528eccc4975a02431ff1cec9997845af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634381530, "uuid": "deffd886-199f-4ad4-8898-c645c6312fdc", "comment": "Malware payload (RedLineStealer)", "value": "6076ec7e8d5fd6e676022ac0be7887e5f85beb449ac89df4dae3589fc13547a3560447d3ce752db7c30bdbd91f8b379a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381530, "uuid": "38708b64-6cc7-44ff-88a7-274ba114850e", "value": "T1F553B67B416150B6C5882730F4B50F0B767CD6251A80B698F04BF2EAEC1D69E9EF87B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381530, "uuid": "57e1c9f6-4c1e-44ca-86fd-87e1bf05cef6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381530, "uuid": "0aaef08f-b58f-4a34-b01d-db9ce903546d", "value": "768:4c4RGP3yWkesGjdAC1Auy8yd7az9t8yJqoSdTt70kv2BqtEW+KeYyg0HUTE/jDbq:4cPJv0Cuu2QuTpR2wSF5j6Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634381530, "uuid": "f253530b-3155-4fb3-a3d4-1ca790013a21", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634381530, "uuid": "76e9c854-c095-492b-86a5-8bab22407e59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634381530, "uuid": "05a1eb04-8128-44d2-ad10-0262d2f670f9", "value": "ddc216e1cbffd1e3e2eeb6dd42f1fc16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4254f68-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380951, "uuid": "2a83ea6d-e330-474d-a289-f45dae3946a3", "comment": "Malware payload (Gafgyt)", "value": "ac83958e4f7ba86cf8983549e954052d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380951, "uuid": "828979a9-eb00-4e2e-a1f1-0185895c5b82", "comment": "Malware payload (Gafgyt)", "value": "e66209fd451916a008eb1a383507ef4be806e0533e83dee9d191d3bbbd865b1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380951, "uuid": "60d4726d-81cc-4060-85b5-f4d2614650ac", "comment": "Malware payload (Gafgyt)", "value": "f2268739835f00cc00bfb33500cdda95fec4e08f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380951, "uuid": "c4c0d4f6-61cb-4fd8-ac6d-54c38f22ded8", "comment": "Malware payload (Gafgyt)", "value": "01bc1f48ce740a4c3e1174a4093481c25d8783eb3df03a1878777967412bf218d0254b94f707ca5785d27cc2a14b7e09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380951, "uuid": "16a68a17-6e07-4c69-9560-7d05f6e86874", "value": "T12A833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380951, "uuid": "9db305cb-e549-4895-b589-74236a8ce96f", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LNWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YZ2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380951, "uuid": "9789683f-4546-44c4-87e1-28697349aa52", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380951, "uuid": "9076b965-265f-474e-a01a-a73735089597", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380951, "uuid": "7f602e9f-2413-4ad2-b758-a5b865ce499c", "value": "ac83958e4f7ba86cf8983549e954052d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611928ca-2e90-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634395818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395818, "uuid": "37c4a402-e2be-4aec-939c-df9595ebdc75", "comment": "Malware payload (RedLineStealer)", "value": "b35d877e740ed85147ea42c27218efba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395818, "uuid": "b97748a5-c8a5-40b6-ae11-a4c44a6fe832", "comment": "Malware payload (RedLineStealer)", "value": "e682687e8165e7139a77badd05fcd4a94a1b9bcaf4945ab62a48de74da1eeebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395818, "uuid": "2a077b03-8c91-4336-9b31-e9d105bfa93a", "comment": "Malware payload (RedLineStealer)", "value": "ec71959a0e1e4e78716723878740a0d8b66411f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395818, "uuid": "f8273254-5021-4392-ab2c-87b2609d929e", "comment": "Malware payload (RedLineStealer)", "value": "290d163a89fa2333aa64271c3051d0936b32464186cb30816d5a250fe23806f9c941a76ae8b660447963a780dfb9a261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395818, "uuid": "6db60634-65e6-443b-988d-49f7d3e9deb8", "value": "T1429533499FE25143D107DC75E81DE4AB76C2CEE98285FB50AEBBC4843A6474CB218F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395818, "uuid": "9d33aae7-f901-4d96-92f6-7b18445877aa", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395818, "uuid": "f89902bc-d5d0-42cb-878e-18ad41add4f3", "value": "49152:TQbucvGni5O50Q3gDiIuuvXaAK26bO4ZXSUOox7ceDK25KV:cbhvx5rQQLuULh6bl7ceDlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634395818, "uuid": "2aa7a6c5-8b49-470b-9c9f-59eec279a9e6", "value": 1979264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634395818, "uuid": "da2708fa-c162-425d-b99a-3c77ea0a906c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395818, "uuid": "9afec2c9-08a8-4657-a89e-aad1ce0bd495", "value": "NBA 2K22 Cheat by Spyro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5369a39b-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634393647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393647, "uuid": "1e0ab128-2d4e-43ed-ba1f-65c4fcda7151", "comment": "Malware payload (AsyncRAT)", "value": "aeacc3be1fad7029ff576ea7a842c590", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393647, "uuid": "62505336-b268-4ce2-8a68-c1497756eac7", "comment": "Malware payload (AsyncRAT)", "value": "e6f2be409cbb65ed65758afcc519a1249080be41bf0cf80c32a2d7fea02bc60c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393647, "uuid": "feffc769-c671-4c0c-93e1-3935901852a0", "comment": "Malware payload (AsyncRAT)", "value": "a1aa2616410f3db60ac8c9a18c9aea333023b0e3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393647, "uuid": "d01e58af-e917-4471-8cb4-5f2d7360b974", "comment": "Malware payload (AsyncRAT)", "value": "ad45f1e39380ceb12f75f4e7d6ef15fcb0c378bf2ff3b4c18e761af49ebd4e48390cb83f43659a04629baebe094e4235", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393647, "uuid": "88126572-14af-4b8a-8ef9-3ad9e00ca85b", "value": "T13F230B003BE8C22BF2BE5F78A8F26145857AF2A36603D5491CC451DB5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393647, "uuid": "66043bea-b3ea-4168-8a7e-fbf41d6236e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393647, "uuid": "69fd4da4-4a7d-4469-9c42-9b5eab6d9927", "value": "768:Hu/6ZTgoiziWUUM9rmo2qrrKjGKG6PIyzjbFgX3iqUGbenUBDZjx:Hu/6ZTgle2mKYDy3bCXSqUfidjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393647, "uuid": "95333e12-70a6-44b4-aedf-11ee667b41e1", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393647, "uuid": "2869ec9f-b6af-4e5f-9aea-de3407d5ddeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393647, "uuid": "857801d9-ba4e-4bb3-af08-82c131218b52", "value": "aeacc3be1fad7029ff576ea7a842c590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495215e2-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634352828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352828, "uuid": "e0d3919b-9549-4c8c-a998-41cd87fc5853", "comment": "Malware payload", "value": "a89561abd740e80aa85b8e86efe9a210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352828, "uuid": "ce58e3ce-6868-4094-929b-507d3781690e", "comment": "Malware payload", "value": "e83f58825c02db8659491fe6e3decec9ada7040baf22de5957fa17477466ca46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352828, "uuid": "4c8639b2-d0aa-4201-adb0-e9b3de89eb72", "comment": "Malware payload", "value": "be16af389573dfba17583ec76839415c590331ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352828, "uuid": "950f4ded-b6db-4f40-a9b4-422a6ad0b2db", "comment": "Malware payload", "value": "4dc4b522eec839e2f687c14d40018d900f8f9e05e1a999f85c854d04924d29341aa3eeca7f517904df30c5f7962fa7c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352828, "uuid": "849ea2af-6612-4424-93e8-f17b7dfa9c33", "value": "T193447C10B5D1C432D5AE29351834DBB19F3EF9309F609E9F77841A3E9F202C19E25A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352828, "uuid": "4df89af2-ab20-4222-8f20-58b9ded38688", "value": "91e63a55e7dce3a4d4ecc648632d8cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352828, "uuid": "8ee3cba3-de5d-43cf-a0eb-9c239b374c24", "value": "6144:DJMnN4n74jGAJB/StfNuuYxONQehv5DBHxZ22UX1wuxYmU92YVL:DJMnKn7UGtuuY8NQehvT6wuxYv9dVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352828, "uuid": "9b4204e9-4cc6-48b9-b49b-dab6e3146d46", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352828, "uuid": "f8e6191d-8c88-43a6-acf3-6f6d9cec01f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352828, "uuid": "b142f448-786d-408b-9ab5-4e8f859f2e1d", "value": "5pVM_b6JOlV7_30Glokmsamh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b34e3d1-2e73-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634383406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383406, "uuid": "43525c5c-2bce-4046-9b5b-348d58a625e7", "comment": "Malware payload (Gafgyt)", "value": "57aba7810470bff1cd06367b42c438e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383406, "uuid": "8eba72a9-aab7-460d-b2c1-84d39f3df653", "comment": "Malware payload (Gafgyt)", "value": "e86eda9f7e61c587fab3194c4ebd8e856c711d3ee0bb38cdb6163c84242c9064", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383406, "uuid": "aec2eecc-ff0c-4a5a-8068-2e37bf872d4d", "comment": "Malware payload (Gafgyt)", "value": "032a968a36c13067b426367881b4bcccd5682413", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634383406, "uuid": "c3296635-44c8-4d91-b568-b14ccb3b85d0", "comment": "Malware payload (Gafgyt)", "value": "87bc7e0942f07b72dd1565db021c33c079f3228f58d2b23a67dad29ed215f297385ce8f1dc0f3b4ef0a9fcaa3dc3f63f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383406, "uuid": "64db8103-3dc4-4202-ad0a-a3152390b306", "value": "T1C8734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383406, "uuid": "e1ac4489-235a-41b3-9a6e-4f93580b193a", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/Cz3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/43Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634383406, "uuid": "9435f2df-02ac-4584-95f8-7d56c2e9878d", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634383406, "uuid": "98a1f0fb-db59-4214-ba71-221a933992c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634383406, "uuid": "a6007dec-0d90-4f1b-a61e-20cdd320ac52", "value": "57aba7810470bff1cd06367b42c438e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1d4414-2e77-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634384991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384991, "uuid": "f26f6083-a2e1-494b-82c4-fb6e02ccce13", "comment": "Malware payload (Gafgyt)", "value": "e6ade9028436e99f5c53e7c5546ad0b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384991, "uuid": "6fbb6ce9-8b14-40d0-b7d5-03f6a4db6429", "comment": "Malware payload (Gafgyt)", "value": "eaf88f7c48f90e16b9e3abafd2e473573a632244e890fca4967448fec602701c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384991, "uuid": "cea5456a-3097-4d64-8a71-b7fa236cfb3b", "comment": "Malware payload (Gafgyt)", "value": "a2c34ade20e41772005cc7002c63b999e1419cab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634384991, "uuid": "1e04d8c9-1fac-4ca3-8677-376f87e1e455", "comment": "Malware payload (Gafgyt)", "value": "aef3167f9e3c83c36720ca4ac49576b48f8eda3626815f80756a365cfa25d94744de0b2284d2beed44b79bb4102388db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634384991, "uuid": "595b9591-9cb0-416d-89d5-1c5e0d83c328", "value": "T17CB31892F904DFA6F40AE63604D74B247630FFE20F932666721739A69E362D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634384991, "uuid": "e3477488-2391-4667-b0f2-c0be2e0d8416", "value": "3072:MvikosJXVl03YA8tyoeNlzmm/lpbOLCn/TNO:MKOJXVl0Yyo6lzmm/lpbOLCn/TNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634384991, "uuid": "397618a0-5108-4e08-b9dc-eff14dd2d63a", "value": 112236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634384991, "uuid": "a603e97f-7ac4-4b33-bcaa-5e5b6a9a919f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634384991, "uuid": "876463bc-2c05-4a59-a568-fbd64d84842c", "value": "e6ade9028436e99f5c53e7c5546ad0b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de617d8d-2e16-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634343629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634343629, "uuid": "123c9469-b1d2-4c70-8eca-c245c751f1b7", "comment": "Malware payload (Formbook)", "value": "7e2a3e68582d3580e14407501fdbfada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634343629, "uuid": "45f66fd7-8ea7-4c38-a2b4-7e49e1232edd", "comment": "Malware payload (Formbook)", "value": "eb32e9891bad691667987b8256f10f59134893b30f405a721020549d3e19375f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634343629, "uuid": "d2412025-d83d-4b37-bfd7-4a641da1a054", "comment": "Malware payload (Formbook)", "value": "e0d0d9c3588a9ecbe34db9650d350332ddbe504a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634343629, "uuid": "7c6d0252-11af-4d02-8faf-cbd09c9fbd48", "comment": "Malware payload (Formbook)", "value": "41a1f235abb95e224d0803fb394084cb64d04677ad5bf0da05de67efc58387fbb03817065dac331a1997f95362b82219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634343629, "uuid": "4fbf82fa-57bf-47a1-95e9-cdf034f38690", "value": "T14A34123632E2C8D3C9A64DB12F376773D6B5C3192160266FBBB51DDA9C22BC74E49201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634343629, "uuid": "c0022c31-a152-43c7-9bd6-ea8a60ee7318", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634343629, "uuid": "cc1081f2-3824-4681-905e-9d2f7250b81b", "value": "6144:wBlL/cgYFEzb/VqJmkNvtJj759mIzl24ka+:CeczjIJ9NbNzlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634343629, "uuid": "cd9e30de-dcfa-4a08-9ce8-3334849af887", "value": 251158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634343629, "uuid": "6b91cd64-6766-4d57-aed8-03f5803f12e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634343629, "uuid": "facfb8db-c665-48ec-afe5-e76d30f2c31e", "value": "QUOTE N \u00b0 067.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ef7a65-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634380956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380956, "uuid": "4c19f266-bb97-4211-88b3-e4ed672f0ef4", "comment": "Malware payload (Mirai)", "value": "c883fca7e90dcd868cfa3dfc88e43717", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380956, "uuid": "bb8a0f15-b3b5-434f-810a-bbfa8c4664a5", "comment": "Malware payload (Mirai)", "value": "eb47c2a8cef8dfa63acc0373371694472e77c38177fca8ed5eeb898ea9bb3e0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380956, "uuid": "826a0dae-d9d0-46b6-a053-ee5dd2b1cfac", "comment": "Malware payload (Mirai)", "value": "5137db97efef0ce00cd16e45b9a36d7a98e1b4a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380956, "uuid": "a7e7f580-9476-474c-9ff7-bb6167934f03", "comment": "Malware payload (Mirai)", "value": "0aa33c63623a332a01c5184be1370c75a50ec2c9f1848e217cf945d1bc08b6c5266a4bc6b493bb5b30bf6000341568ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380956, "uuid": "66191790-03f6-473f-b412-fdc9786dcb11", "value": "T17033F884F98B85F5D9078C3050A7F13FCB31E97940B0D66EEF9A9F35DA3B941921218A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380956, "uuid": "b0451b99-be58-46ed-b4d5-fd50824346be", "value": "1536:a0OrxIddROckRI1j+MG7NK6YniPhcLtJzQ9:a0OIddROckROq7NFYipcpJzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380956, "uuid": "409ed170-d099-40df-8fa7-14686a6750cf", "value": 54192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380956, "uuid": "662ac2f2-e197-4346-a691-bc3c10701c4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380956, "uuid": "2936feef-7cc9-4c04-a89b-7237c26ed5bf", "value": "c883fca7e90dcd868cfa3dfc88e43717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9d4b5b-2e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634394599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394599, "uuid": "fab4a2d2-c097-4bba-a46f-1a3da6d4bc36", "comment": "Malware payload (Smoke Loader)", "value": "48e19802f91f27e12638631ff2fd877a", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394599, "uuid": "a1d229b9-f651-400e-900a-8ca628a96d1b", "comment": "Malware payload (Smoke Loader)", "value": "ec9abd41cb8dc44222977d171e58a8f2f74ca3499a2b552aee0aa963ee553d77", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394599, "uuid": "e2001fd9-597d-4226-aed6-d4fd50148862", "comment": "Malware payload (Smoke Loader)", "value": "25ba5fd7bc80335bad6b68667091ae04057cc4fa", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394599, "uuid": "8fcb24da-e94e-47f3-b17a-1612586b2e88", "comment": "Malware payload (Smoke Loader)", "value": "ec5a1585312bdaf8bc2e6a72e8e4a00f8361eac5bcc969285546d74a664509adbe65f70e5e5585662ec703d1426b3f0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394599, "uuid": "b17220b5-fb3f-4e25-bb40-5ae2fa679b1e", "value": "T1B1548E10B7A0C034F5B752F845BA9369F93EBDA0AB3494CF52D526EA56346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394599, "uuid": "8823cec4-4bd2-4c0a-ab52-691f6870e7c2", "value": "a555e45e65025d1329998e0444346913", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394599, "uuid": "bbe1658d-833e-45db-a009-4f73b152e335", "value": "6144:I5JXGsnLAKwctA7DgzvuOsKrjzF+HX4GuIH2DVThH/:Itz1A7DlOs8zhGuIH2D1hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394599, "uuid": "b1f6641c-69fe-4a7e-b199-dd91d5df82e2", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394599, "uuid": "774fbbb6-e47c-4066-8a85-fae229ceb1ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394599, "uuid": "3aa0dc84-acda-486e-9053-ee4cd8a7de63", "value": "48e19802f91f27e12638631ff2fd877a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586635f7-2e8c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634394085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394085, "uuid": "8ab927e8-2acf-43df-9aa3-9642d7160e2c", "comment": "Malware payload", "value": "15cfd67f23657028cb709ece3d8e62fd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394085, "uuid": "60137172-2782-4a37-9305-1b7f1eb2c1a1", "comment": "Malware payload", "value": "ecf1b59c7b76fd84b6691a14c46fe9c6186acdfae646e950d1045fa5a3736c11", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394085, "uuid": "dbfd3912-d037-4882-8a05-e2232c8b57a1", "comment": "Malware payload", "value": "84f5b893981ae2db12bdfb245c86cae496b4c69c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394085, "uuid": "11195588-0934-40d0-a42d-590d13988f94", "comment": "Malware payload", "value": "3299ab7041e44490092555d4dc022c89fb61376ee8b68b71295f5bc9d375e03ace5abc6626c55fdde41addc95f1d2223", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394085, "uuid": "5edb1d2b-b800-486f-9f48-5016c360b895", "value": "T129E5F129F246C599C3278674C416E2F233A49E4B6229C72E30C53F89BC757367B2A51F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394085, "uuid": "8198fad4-cb11-4985-85c7-ea3d21dd493c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394085, "uuid": "469b7ffd-2ee7-4ed1-b8f5-2ef524fb3c90", "value": "24576:q3OgaE6wH0YSMR0ZuKNXtQHjl94j9srIq7w0HqOT7IsMCfrXB4h8iaVAYYb9ra8k:qFirtOjTSi7j1DXyh8ij0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394085, "uuid": "32c8ecc3-714c-4cd3-b054-087b6946dc4b", "value": 3069440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394085, "uuid": "c6001753-0911-4281-afdb-d93498d16fa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394085, "uuid": "4f64f96c-25b6-43ee-87a5-e576fe0f1081", "value": "DHL_Ship_152021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384b7898-2e46-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634363966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634363966, "uuid": "634d9bc4-72da-4dcc-8612-f3d4c1658dc8", "comment": "Malware payload (AsyncRAT)", "value": "18f8f638f3f96ed6928645b005342850", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634363966, "uuid": "0e18580b-6f33-42ee-8ff6-d7ca4c694b28", "comment": "Malware payload (AsyncRAT)", "value": "ed6542b41fe729372b4cd2b768056ced22c5ecba8fc7cde8492be6bb300e5d15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634363966, "uuid": "ee982ed6-c8ff-4ea2-bb39-5c89f05179ba", "comment": "Malware payload (AsyncRAT)", "value": "a71b1f74482f72ce87bbfbfd18cdd6a12e24dce5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634363966, "uuid": "88e9e849-a701-46ac-a2f9-a0096c5b2d26", "comment": "Malware payload (AsyncRAT)", "value": "b6cd7171a877da1173c5013a14ae75224eef97a54b9336f2393e2c8fbcccb01deda9ccf22e9217c0a8238b8580fef133", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634363966, "uuid": "06ccbb99-92f5-4245-9d0f-8cad41daaa75", "value": "T1F0630259AF243FED3C7C0E03C1B39535958E7EEFE8A51D0C483490834B46E666D7658A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634363966, "uuid": "b44695ad-1ca5-4e70-be83-a1df1f8f9e70", "value": "768:MF0jbVI66tg4pWRgFJknD+qqViCoVY1v/3rMCCvucw6WUiH3Bf9SnD5FWT37vAHX:cE6mVgFEaxl/1nzVsiH3Bc/WTLv09Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634363966, "uuid": "e6fa121f-5251-46e5-bb86-4028ab17ff3d", "value": 67492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634363966, "uuid": "3fde58a0-ba8b-4ad7-bf87-1710014ee04e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634363966, "uuid": "431696f1-cadd-4be7-b676-f74a596af291", "value": "SWIFT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22da9bb-2e7a-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1634386505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634386505, "uuid": "1665f873-9249-44cb-a12f-d30a8dfd01cb", "comment": "Malware payload (Tofsee)", "value": "0f7fea936ac9aaf62528ed30373c838d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634386505, "uuid": "142982c9-6b0e-40b0-9472-a14c7ceeabc7", "comment": "Malware payload (Tofsee)", "value": "ee6cb977e78651d7b9a3fd412a40f6e2cd1501f05b04c49e744db35c83181132", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634386505, "uuid": "9da55f15-e5dc-43cf-8a02-1e49fcb5cfb6", "comment": "Malware payload (Tofsee)", "value": "262413c6eee91c797806be1a22394036bf84b633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634386505, "uuid": "e480bddb-bc65-4542-990d-d59f3a49e607", "comment": "Malware payload (Tofsee)", "value": "42f7cdc99c633140e624dfae545bdddd785f94b5968edf9497dce6e49d86887fabdb757c518fc578dc6a21f7145a4de2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634386505, "uuid": "aea20faf-2275-4f49-bc5e-5ddd659992ef", "value": "T122548D10B6E0C035F5B752F849BA9379A93E7DA0AB3490CF52D526EE56346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634386505, "uuid": "364b0f6e-f5a1-4b58-851c-026860ffd92d", "value": "3053f2a72602e54beffbd9d286711499", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634386505, "uuid": "6f81a039-70e1-40f9-b685-e45189a6f34c", "value": "3072:mu0XiLyS0KcBa2lQ7y4zp+VaYzOeS9OuiNwWHFwIQnvIByI/JTEqWpGxfZz5LjI7:72aG4y4zakOLn9ByI/JoNpGjRI0LPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634386505, "uuid": "cc5a19d4-f484-40fb-8044-b1f0c8a4ae74", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634386505, "uuid": "56982dbf-87ba-44e8-982b-b555dad121fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634386505, "uuid": "77a9b5d6-6c18-44df-bcac-9a0ec0460c62", "value": "0f7fea936ac9aaf62528ed30373c838d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f28686b-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392378, "uuid": "d6f97db2-43a4-43d1-abe7-09995bc08cd2", "comment": "Malware payload (Mirai)", "value": "503be467e0d56162edf89f59a1df6276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392378, "uuid": "5e81074a-4f31-431e-a32b-9714ea8a4b6c", "comment": "Malware payload (Mirai)", "value": "ee9e7eb85d18eef9919a676af1601baea3f903bc7308bc99628d544574ccd72e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392378, "uuid": "c9a36b51-4a45-4b61-8820-758a3f758b1f", "comment": "Malware payload (Mirai)", "value": "a0914e12bc869ea35d0ec3f11a970a23bdb9f55b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392378, "uuid": "37bfd872-95af-49d3-8669-ae6010887db6", "comment": "Malware payload (Mirai)", "value": "0c222172fc35a634735e4d6df784e8b84a1ec827a2a484245643f11b68d78880a44c1add26de144d83ea0f74a930790e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392378, "uuid": "48bcbda7-f70e-4c31-80df-5a57566e2a87", "value": "T1C5E2E115E18637F99AF42832CA25C34361DF2AEEA8D67123A70D169C7892047F1FB593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392378, "uuid": "b46dc657-79fb-411c-a594-8e4700477a87", "value": "768:YJKPBT0+XV+oDuODuymiwZm2qJ+bu6Tygq3UIi:/T0+XUxODIPqJ+S6yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392378, "uuid": "3803a203-96f9-46c0-b4aa-5d347c043b90", "value": 31492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392378, "uuid": "9fe09713-aebd-4bdc-b7b6-b6951d11df8a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392378, "uuid": "77fded27-367c-434b-b3dd-d1795837068b", "value": "503be467e0d56162edf89f59a1df6276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e9db7b-2e88-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634392385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392385, "uuid": "820164af-7b79-482f-80bd-eab90bb6595a", "comment": "Malware payload (Mirai)", "value": "27b31ad80c9872c45862a6e6e3420344", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392385, "uuid": "f96caebb-9ec1-4055-8510-7dbdeef867eb", "comment": "Malware payload (Mirai)", "value": "eebd97be93fb96d85320a8241e41ac4a8d87bd5f0e2a0f77a49605bb2c65d99c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392385, "uuid": "9f95d9e8-c6e2-4df6-9a62-b7699b964400", "comment": "Malware payload (Mirai)", "value": "40404f6ea9aa581d31a07f4ef1c37e1e5108b1d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634392385, "uuid": "fbd86e05-327a-487f-8271-dcb247af03c8", "comment": "Malware payload (Mirai)", "value": "bb794a2df677acd938a41eb250421b65ff054669c290eb79afd81fcb7afe394a4c275c46c57785808630033f240e105b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392385, "uuid": "259f0d6d-ca79-407c-be3a-2228d6565f3e", "value": "T13AA2D1D1B0CC56B387E04435FAED428A7A4D2A7ED9C336A4D510977886C248A5BFC16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392385, "uuid": "e3f7e3ac-bd1a-4e61-a66a-2aabead791b1", "value": "384:2eQ79GQ6g2P+Eitn1cqiGwWyrpcExYw6Qmk1GVNnjLKcAL9IhdmdGU5EJ:FQRw+Eyn14G6rVY21ijLfUIP3UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634392385, "uuid": "18433683-e9f3-4d6d-8c93-e1942324d2e9", "value": 22636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634392385, "uuid": "21a67c04-0b1c-4521-8b36-cb82d99c28d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634392385, "uuid": "966305b5-1397-4262-99f0-ff707be435ca", "value": "27b31ad80c9872c45862a6e6e3420344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6cd87c-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634353125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353125, "uuid": "86c0d167-4e94-4cd2-8b8b-d63524823e3c", "comment": "Malware payload (Smoke Loader)", "value": "19b0bf2bb132231de9dd08f8761c5998", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353125, "uuid": "be2905d5-8e7b-4593-869d-79875467f54a", "comment": "Malware payload (Smoke Loader)", "value": "ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353125, "uuid": "db903a39-621f-4218-baff-52562773b3ea", "comment": "Malware payload (Smoke Loader)", "value": "a08a73f6fa211061d6defc14bc8fec6ada2166c4", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353125, "uuid": "29ca6462-e3a6-488c-88ed-d18022bcfad2", "comment": "Malware payload (Smoke Loader)", "value": "bf494e04fc560aa9a555880870e85967eb846b8f380ba053dfc67345a22d7d5d6e41e7908d1d89c1643220c177101e04", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353125, "uuid": "973e4a6f-9bb2-44a9-a53b-fc736b94e355", "value": "T108844A34E301F026F4E20435AC6DD7FAA4286B30275548EBF3D55E69ABB56C1E230B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353125, "uuid": "b5497e02-5491-44bb-8fef-38d06e98ab96", "value": "f4a871a2917ab02363311f9479a45646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353125, "uuid": "3c4ce87d-f9fb-4654-a4f4-4c547f9e2c42", "value": "12288:F+bMtwrleoUUcdl5gs7wSYbHkZPu/KjGHH711P5b:FDtUlCdl5v7GkQ71JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634353125, "uuid": "9499408d-adae-4bea-bc9d-158808517e4e", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634353125, "uuid": "d02d530b-47aa-47e9-a4c3-779638308bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353125, "uuid": "7a4169ef-2c7e-4e38-95d4-9c38b17c14d8", "value": "UTJTSQdX9ITDLyCRBKvHrxJ7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f33639-2e4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634367425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367425, "uuid": "d19d85d0-9f01-40d4-b67f-78583db21320", "comment": "Malware payload (Mirai)", "value": "5d172a7e06174afb25493ad5bd483585", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367425, "uuid": "40c56ade-e5df-4334-afba-0805351d4ba4", "comment": "Malware payload (Mirai)", "value": "ef2d3c5afd841afec8fc9dc915ef3c72888425f82f434ab2da44994466515d4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367425, "uuid": "c704f8e6-f285-4037-8366-5dc7a2c50023", "comment": "Malware payload (Mirai)", "value": "89d641f9b444b931f9ed498463fbfd098e752ea0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634367425, "uuid": "16de69ed-1f32-49b1-b2cf-9475d8aed0ab", "comment": "Malware payload (Mirai)", "value": "26db04fa47bf5b2e168d3b8e44a71972844a4b14ed73e0f24087095d6b643c6bad289a9dbc17e9524df229abf482f89e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367425, "uuid": "f8a9aa9d-1cb7-46f8-81a0-8bda5d552a34", "value": "T105539DA5C4B8BD99CF69927CB61488389723900565A33DFAE742C796D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367425, "uuid": "954f3ff0-c397-43d4-9f65-534e59b142aa", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC1C2:BjiBGhGp+XZxtf+d21UYjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634367425, "uuid": "b154f026-f3d2-461b-b761-21f64c61db7b", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634367425, "uuid": "9a1cb7d0-7b49-4d35-92af-10701e6ca5c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634367425, "uuid": "6f2dffb1-47e2-4515-967f-93764f4279ae", "value": "5d172a7e06174afb25493ad5bd483585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1429099-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380947, "uuid": "291fc972-ffa2-4e69-a864-19a3fcddecfc", "comment": "Malware payload (Gafgyt)", "value": "1db2e5adb60d4078e8fe38f6f1c73e84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380947, "uuid": "1ae80bcc-f27a-4916-ac3e-7ecf111db73e", "comment": "Malware payload (Gafgyt)", "value": "f1c09f545ad85301a2aed5762c4de2d7a4a64f9ed799bf8d1d7a87edd1d56618", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380947, "uuid": "a164fb28-1cf2-4f35-a95c-1ff008a14f2f", "comment": "Malware payload (Gafgyt)", "value": "318c179d948524a291304909ed390107c6e99b00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380947, "uuid": "349c7c72-0295-4e57-98c7-2ee16259bb6f", "comment": "Malware payload (Gafgyt)", "value": "a843e4fb9a20d57d5dd3838d7d56908148e778042bbd57a1e9abb63514a0509beacbb1c3df8f5d186b460457a7994a02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380947, "uuid": "90b2d29a-dcd4-431b-9b00-d05e34c5576e", "value": "T1EAC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380947, "uuid": "34b7c57c-bdcb-4b1f-9d45-ac1757e34489", "value": "3072:ekYPUfsgnsb0J2ag/VfzkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0zkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380947, "uuid": "acc46f1f-a24c-4fbb-b7cc-df273120bbf0", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380947, "uuid": "846fd56b-39b1-4c1f-9f68-97a9def5c5bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380947, "uuid": "a2591662-b0a5-4827-b345-6d946a8b7c04", "value": "1db2e5adb60d4078e8fe38f6f1c73e84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dae6260-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634393557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393557, "uuid": "9d7e7090-d83d-439c-8f7f-d20f5ea9cdd9", "comment": "Malware payload (SnakeKeylogger)", "value": "6c935e4cee8be39256fe622969c7e512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393557, "uuid": "f437b946-924b-40fc-9581-f3e93227f605", "comment": "Malware payload (SnakeKeylogger)", "value": "f21abecafd0a06299d0560608619e6ad938f4f032c1c6b2ec50a720268a9c58a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393557, "uuid": "09b0eb3d-8b55-4934-8da9-6f7358ff1993", "comment": "Malware payload (SnakeKeylogger)", "value": "7909d2bb72311042559ad78197b17777a0c5ac80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393557, "uuid": "e08779e5-dd46-4d81-a63f-ee7aa276d073", "comment": "Malware payload (SnakeKeylogger)", "value": "97a2e122ecfdd5a4b2c64c6150553fe24dd45759e0d7546fe1979d84eeb6bd982e9d7d024963f5d9e6ca6efdc254bd98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393557, "uuid": "197b6eef-fb59-4db9-8e9e-15c4dd525d93", "value": "T111A4E082351C41F6D7782A7B3997A34C7BA23EF11943C14D6AC2F11D1AB17A90EB2277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393557, "uuid": "4861428e-842a-49bb-a211-0f6e458a2625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393557, "uuid": "f5bbd693-2700-406a-9bfc-5f15692aa2f0", "value": "6144:xiB6Uqrl5J+vq/PA1wGJmVj+VO/A93Xp8VDkN6nuVW+OJz921AsOjzEkZjbYcT0d:xiYU2JQq3A6MgaCc5kDU6uP0YkZwaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393557, "uuid": "e20f8e4b-09bf-4693-8b1a-288bad2ca4f2", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393557, "uuid": "378e4a6c-45a3-4971-b7d2-1f28f9af7005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393557, "uuid": "8fd71d37-3059-4928-8b08-3190085adc17", "value": "6c935e4cee8be39256fe622969c7e512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1113db7-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1634353083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353083, "uuid": "7d85bee7-802b-417a-8f4c-cc5acf4765e0", "comment": "Malware payload (CoinMiner)", "value": "3a82ca6f313cee5b8b525a9bd1bfb4fe", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353083, "uuid": "846c0a9d-a969-4d7e-bebf-cbd675c159f0", "comment": "Malware payload (CoinMiner)", "value": "f2866d013e000884415fa13490799a626792a29967bf20e7bbbf23a72c0fd7f7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353083, "uuid": "f482a3ff-f57f-47e5-a364-d409a36b93c4", "comment": "Malware payload (CoinMiner)", "value": "3be2fae672c9da5381dbba1c111b51ba43a7020f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634353083, "uuid": "d0c8d50c-b714-4b91-8066-6c9a2faff675", "comment": "Malware payload (CoinMiner)", "value": "011de2d7e65c1ef8491f3a0d6fd52738feee36362a0f06bd4e893049bf1e25db6513e18e140f0e09b4d119e90c975082", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353083, "uuid": "d81fc86f-bb16-49b3-a68e-2bde29c95289", "value": "T145F412D4B040C0E5D461673368E284DC662ABD57BE6F973620DD3A8EA63624C71373BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353083, "uuid": "5de9af89-df38-4d46-b9dc-3d78f30b9d00", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353083, "uuid": "e0b2a476-e58d-4b6b-9ee4-4dce2b7cda76", "value": "6144:d/QiQXCgVe5m+ksmpk3U9j0IZ5usoxvjFEOTb9WmZX/8shzdsY4CpHPhniZVf:VQi3Aec6m6UR0Inup1hf39Wkv8xwJGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634353083, "uuid": "6bf1d1ec-4f3e-489c-824c-3274acfab4ce", "value": 762045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634353083, "uuid": "47b369f3-7664-4d22-b430-5d4847291653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634353083, "uuid": "a21a6f1e-e3b4-4e18-82e4-da0ac75ce151", "value": "uFvG6DlSUpNCq_0a0Y3vNrYQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bf6121-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (ServHelper)", "timestamp": 1634380286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380286, "uuid": "cf0824f7-a6e9-4357-a7a4-f05b228688bf", "comment": "Malware payload (ServHelper)", "value": "2e3b62f4f1669b3615608ea31e1796dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380286, "uuid": "c4eefa07-e7eb-40d5-aaea-1c9e333404bd", "comment": "Malware payload (ServHelper)", "value": "f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380286, "uuid": "fde38946-7268-4752-a8ca-39c130904a04", "comment": "Malware payload (ServHelper)", "value": "9f9584588e480c0cfc18b770da47b00919e24219", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380286, "uuid": "6cfc927d-3e43-4c62-b4cb-42e311f7ab72", "comment": "Malware payload (ServHelper)", "value": "679398248a8626297cc25bfe5015d7def04ed3d474d10817183a26a916a79dc4ce216ee5dc3cb17eff32c3800b00f234", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380286, "uuid": "b6b9f5de-2663-464a-8551-3eacc0c1c095", "value": "T143660231B183554CC52A0A784429EAC772B46A473ABDCB2E70CA274CDE0567F7F2616B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380286, "uuid": "2633b249-0f54-45b2-a5bd-b02b94d2237a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380286, "uuid": "e54e184a-bb0f-42a5-8320-c249321b2b16", "value": "196608:2a9Vx+sUr9oXdfrwknr+VCvnteQaOIkp:t+x0dfrFny8vnDVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380286, "uuid": "d90fb665-23ed-4402-90e2-1ea429798d79", "value": 7056896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380286, "uuid": "dea7ced6-91d6-4722-96cd-455cc06b3d6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380286, "uuid": "968c0abd-8399-47cd-88b9-18b4e750a837", "value": "2e3b62f4f1669b3615608ea31e1796dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8a88ae-2e25-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634349881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349881, "uuid": "27150149-9ad0-4874-abd2-b8663d3f919f", "comment": "Malware payload (Gafgyt)", "value": "aaec2934c77e76f3aea790db04d742b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349881, "uuid": "cdb6a4a8-8d91-4898-a1a9-c7cf5083714b", "comment": "Malware payload (Gafgyt)", "value": "f5c6a74b0193e36c78e9a62bdc3ddfdd5cfa6d48fb3420ce29a13a5dded0d7ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349881, "uuid": "7569fdb0-ed48-4c22-ab32-e583dd18f259", "comment": "Malware payload (Gafgyt)", "value": "7098a84760bf88a20203b9b42fd0ece5586c166c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634349881, "uuid": "1a002fba-fcf8-4967-a172-4cc1454993ff", "comment": "Malware payload (Gafgyt)", "value": "72d35eb7c2d0ead0fd006e8c13bc714ab0314f6dd8adb6a275e88c905131217bef463d178a46e8ce5e702edd81c3c245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349881, "uuid": "2789b845-7f7e-41e4-ad75-1e5fd98f24cc", "value": "T1B3833C45F743C6B3C8830BB2029B9B5A4931B9BE1A3A9F4AF31D3CB4AB124D87115F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349881, "uuid": "068619e0-9e3e-48c8-887a-50c84f3a9fca", "value": "1536:fhviloRFMEWnsTXgeYPQycOd4pCTWp+uvgmL+UVOz+sXUfJ7a:tiloH6sTgeYPDcbgfAgmKUVOz+uUfJ7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634349881, "uuid": "658ee843-a201-4f7c-b6fb-3c89e931b4ac", "value": 85433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634349881, "uuid": "20fb19d8-6ff4-47b7-be0f-c881a131df7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634349881, "uuid": "8716d772-2456-4eba-b1ad-5e44cdee78cf", "value": "aaec2934c77e76f3aea790db04d742b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365ddb84-2e8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393169, "uuid": "59c76484-8a3c-43fa-b1c9-a381591d5acf", "comment": "Malware payload (Mirai)", "value": "010beb75a033b368d12da1537ef4f8b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393169, "uuid": "b0f7672f-592f-442c-aab7-f1638c94ae78", "comment": "Malware payload (Mirai)", "value": "f5cbf16504fd809daa1fb07c8f26c53131d640e974adda62c006396e5718eb6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393169, "uuid": "cf383b03-1e48-4ff6-a242-2c7b0e3da566", "comment": "Malware payload (Mirai)", "value": "893f6b980aa78c96856d142f0478cc56bc59f4b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393169, "uuid": "d91dadde-0df3-4c06-a069-443156e4bba7", "comment": "Malware payload (Mirai)", "value": "87de9f32e8d5b4b183a93c58cc5fc75a713f2ddaaa2c76faccf3c0f09bb843e44b4edf67ff72e96331e24ae021e0fa25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393169, "uuid": "638c0568-817a-4bb9-844b-6aa0fe8516e4", "value": "T1EE737109AFA14FF7E8AFDC3349E91B4525CC651A22A83B75B930D428F64B64F14E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393169, "uuid": "e4b87933-278f-4df8-ba86-49ba16e9f35d", "value": "1536:5b21YxcQgIXRHV8KIYv8tms64yKNbZ+yZUe9:h21Y+QgIXR6KI/VNbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393169, "uuid": "cd1478a7-3b16-4591-b8d5-a9d0f40088b2", "value": 76072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393169, "uuid": "882342b6-bd5b-4d8d-87b5-1339c2fc9b61", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393169, "uuid": "eadffa10-f418-4f5e-ac1a-d1e090ce8549", "value": "010beb75a033b368d12da1537ef4f8b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b591b7-2e8c-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634394111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394111, "uuid": "c8f4b78c-21fa-4059-8cf8-f8087e7c578c", "comment": "Malware payload (RemcosRAT)", "value": "6e2c6a9dbd0b9665b7c726e9acb6aef1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394111, "uuid": "949754b9-5699-4e03-bce9-48975127f223", "comment": "Malware payload (RemcosRAT)", "value": "f60b6dfcaf466a9cf6b7831fcd74abc70efc16aec11d3b38fdbc7562003ba61b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394111, "uuid": "980c88aa-2630-4f90-a417-615f3d27fadc", "comment": "Malware payload (RemcosRAT)", "value": "141882364e949e4f50fb82a7dca3b92dd3371a61", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634394111, "uuid": "980a6458-1dca-4681-b9c2-d7ee9bbafc13", "comment": "Malware payload (RemcosRAT)", "value": "4743a58db077be4d070131ec39c2a52fa87781a6490be07a8d78c1ad40cd2be65af3d178f665cc94c349c02cc3490bd2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394111, "uuid": "d1a972d6-4788-43f9-93f2-593cd0e65cbc", "value": "T10525AE91B39684F7C2135378CC7B4773ED74BF912B61664D2ECA39188D72A80B21B687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394111, "uuid": "3112c6cc-f7af-4bfc-abda-84c0fd2da775", "value": "7e0b35915997b61b69492f2ad70638c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394111, "uuid": "dad75c03-9028-4635-8173-489d82d38f45", "value": "24576:NddzmAfhuBXTG8/j7MMh2sXe5q/E5X6TvA/h:NdlmGhuNBec/E5XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634394111, "uuid": "63d8aa49-0831-404d-90ad-335860c2191f", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634394111, "uuid": "711b69c3-2d79-4743-9db1-5ddb1eb51292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634394111, "uuid": "415ca160-7aaf-4a7e-bad1-ce8f57652ff0", "value": "DHL_119040 \u0631\u0633\u06cc\u062f ,pdf.\u062f\u0633\u062a\u0627\u0648\u06cc\u0632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf1d154-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634393876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393876, "uuid": "4c303623-a61f-4f2a-a944-403b8c093d41", "comment": "Malware payload (Mirai)", "value": "00c203e73722df0ded7ff10fe72a0c7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393876, "uuid": "9142d9ce-76c0-4a31-b4ae-940b0c83af48", "comment": "Malware payload (Mirai)", "value": "f623ecb2fac9d2290daacf8ebdb561f531b290936b2e834cc20b04f875b20f83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393876, "uuid": "19cab7d9-6e52-4175-b744-a2464bba5bec", "comment": "Malware payload (Mirai)", "value": "844eb1efbf9b4cbbd2fcf0a8a0451c11dd1998a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393876, "uuid": "05d7957f-ac8d-4e90-bf63-ba5dbf1618dd", "comment": "Malware payload (Mirai)", "value": "054394521e85527968558d6953a90cf7603b5f981b436a104e84a8491ec65ac9afd4527d1ba5dd759ff664c631a7a3c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393876, "uuid": "ada032a1-a4ff-447c-ae6b-031bdefd9392", "value": "T13D434BD2F800AE7CFD5BEA7B85114A0EF521B26449620F77A337FC93AC720A6591AD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393876, "uuid": "3134527f-c6ea-4bdc-a3a8-feb728a4f80c", "value": "768:kND3ppW26BHP1oeTM4Y5Cgr4DVpPSdODOuEYP1Vmx28FsW3jc89X:y1pcBv1o6c9+R4ODnEYqx28GW3I8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393876, "uuid": "ca5e2343-8aaf-430f-aa83-a3419376d97a", "value": 59708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393876, "uuid": "e6ead71f-9e1d-45da-ab1b-46ba6f88212e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393876, "uuid": "0c7a8c15-b44d-4a4f-a1df-f6ddd7b03f69", "value": "00c203e73722df0ded7ff10fe72a0c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3437c0-2e90-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634395860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395860, "uuid": "f5da6e1e-95bc-4d87-8851-ca96f0089841", "comment": "Malware payload", "value": "60697ac5ee9a09790941c1571e16ce9d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395860, "uuid": "a5b4468f-d5ed-45b7-8282-436e7849068c", "comment": "Malware payload", "value": "f6573c423f071f3dc32b5cd73260dc660e049647705aca592cb8bc04c0d4d780", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395860, "uuid": "a1f1610a-e029-4526-99c3-8e501c4413e6", "comment": "Malware payload", "value": "12eef2844adcc7f5fd32758c704f576e3ba982be", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634395860, "uuid": "5694a690-f228-4210-ac3a-c44c2da2e844", "comment": "Malware payload", "value": "4ba4f0a626450427fad5349e7de0376ede1d436f8b262aaa0d549949a52283307d7993ada464e2b7812088c14aa031ff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395860, "uuid": "be1b59fd-f827-4ba5-a809-69bd5a844820", "value": "T1DA95337B05ABC462D107B57D0D43EBF935AA49ED142944F98FF542284233FEA842EC97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395860, "uuid": "76f1cd6e-fc88-4cc2-ad37-44ce6a8ba7bd", "value": "49152:7Ug4iPiWqMa4TOnGI5k0S/2MuaEwc22RERW7uO96:Yg4yZJqv9S/2MurRXeIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634395860, "uuid": "75f370c0-914e-472f-988e-0327b0bc4ba7", "value": 2027531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634395860, "uuid": "9aa3c93a-2108-4004-97ef-42f2a14451f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634395860, "uuid": "611fbbbf-7339-420e-a01f-a02758066071", "value": "NBA 2K22 Cheat by Spyro.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c622ff36-2e63-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634376660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376660, "uuid": "0c51fe84-79da-4a6a-952a-bff2815ffbb8", "comment": "Malware payload (Gafgyt)", "value": "eea09960b524a8ac42fa18345befc925", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376660, "uuid": "c7ccff3b-9633-4903-a4c1-19b56e1074a6", "comment": "Malware payload (Gafgyt)", "value": "f67efc3b176029660d6942351c1844cfc22eb6395e5932e4a9336394d7a94287", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376660, "uuid": "e3f3a53a-bc11-43e8-b7e4-8b1757febf2e", "comment": "Malware payload (Gafgyt)", "value": "307b902b7fbe67b322a8cc33d32e35ecb050c62f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376660, "uuid": "38e235bf-a091-4d00-9c8f-996dcff7d6a0", "comment": "Malware payload (Gafgyt)", "value": "db65fc22d9c9c1467fcd9fec47c23a29e59effa06ad44303d543516e7b2580cf18e4d5d7dd73027f7fac512357f902eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376660, "uuid": "d080b3de-6d90-453a-943b-7b8f8d1def01", "value": "T1A4F33A06E4504623C1D22BB6B29B528D77231FF997CB3352DA247EB02FE175E1A399D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376660, "uuid": "ee8376de-7caa-458d-ad2d-dca542cb079d", "value": "3072:OZBd1RjICQm/BEnBNrDKkckPigJanCeaLGzr/sC8etJ8add9Qzhs7Amc3UjGmyLo:nnBNrDKkckPtaCe5nsC8etJ8addQWAmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376660, "uuid": "446afaa6-a78c-4e77-bc6b-b0e1321d445d", "value": 164276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376660, "uuid": "8a9ef2e6-ea7c-4652-ab2d-4c7b9aa61aa5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376660, "uuid": "9bf86709-94e6-400c-a65b-dbdef802b71d", "value": "eea09960b524a8ac42fa18345befc925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb9819e-2e5a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634372562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372562, "uuid": "1c454025-d76f-4230-92ba-fa2dbca22ba0", "comment": "Malware payload", "value": "5a2a01f54dd6762d8ae0839f63fe0191", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372562, "uuid": "7e1dfcb8-b5c6-431f-b05c-e3081bf3b5a5", "comment": "Malware payload", "value": "f72cc6fee6ed792cec19e93ba67f70438f01174c1098852919c100008ef32da0", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372562, "uuid": "4e085c03-f316-4bb9-b796-7b9c028aa5cc", "comment": "Malware payload", "value": "64dc09aa24526ca22c19d42ec7b109e156b16568", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634372562, "uuid": "c6e1231f-43b8-4e49-90a5-b47c8d59da1a", "comment": "Malware payload", "value": "7734f4d779fa9ea0530c06b988528d79097bcbcc51a9b484bf0786acc4d7e6d54da3b3b31165c622f85110cfb77e8475", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372562, "uuid": "5ec215bf-6cd7-40e2-b9e9-a1589fc275f3", "value": "T1D8B42370661B6112AA93168F379F932017FA459DC58E586B05EF78FC2A062333EF4C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372562, "uuid": "dd4c115b-de8d-4dfb-9b55-38b54e9cbb58", "value": "12288:QUl8S20EqBESpe0TssYEZ2CED90PmExjbsBVH7OjX:rJ/EqBEke04gZ2vqm02VbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634372562, "uuid": "7650cb41-4ce6-4def-b6f3-ab44338cb348", "value": 495823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634372562, "uuid": "3cbf5296-8bf9-45d2-a62d-6a6c96a16855", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634372562, "uuid": "a7a7065a-2e29-48ba-8027-a44561b85716", "value": "Commercial Invoice.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5340fa4e-2eb3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634410827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410827, "uuid": "815690fb-7fca-4b31-9f85-3752cabafc29", "comment": "Malware payload (RedLineStealer)", "value": "cb56c8b9587b7d673f9a31ef1daaad4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410827, "uuid": "6f9df7f9-9f88-423d-9b9a-8f1b02e5893e", "comment": "Malware payload (RedLineStealer)", "value": "f79edc777c22fecfe033890a6541e0da5655ae2c7ba804be77205e30105475cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410827, "uuid": "89fed787-8fb4-4054-84c5-aca462806522", "comment": "Malware payload (RedLineStealer)", "value": "c184c9aadf5b196cf6d2d30ca2902cbc476d9808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634410827, "uuid": "1fc51cda-7b57-4f05-b0be-7e61db8239ca", "comment": "Malware payload (RedLineStealer)", "value": "01f3e3bf12e8451ef70e171b6895a392362071daddf37eeeb3f237b1a996563cbe9bd9ebd7f80776ea16de3c42ca926f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410827, "uuid": "3b694c62-08cf-416c-9a34-1ed7b3cd8180", "value": "T16084BF00B6E0C035F5B762F44ABA9378B93E3EA16B2494CF52D516EE56349E1EC7034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410827, "uuid": "6a34c499-7e4e-4d3a-a825-efa341c243ed", "value": "3053f2a72602e54beffbd9d286711499", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410827, "uuid": "9ddb402e-6fef-4ca7-9691-92b9a592cfe5", "value": "6144:YjKakysoc2KGZhZdJXr3Z5egFuBNWge7JyGWNfJOhu:a5kLo9hZP3Z8gF8WeGWNfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634410827, "uuid": "004db2e3-9f69-412a-9b24-1ece6787d540", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634410827, "uuid": "c171c004-db25-4d6a-ad2e-89d50a9e3424", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634410827, "uuid": "99de83b0-7534-48ac-ab21-ac701cd6fc97", "value": "cb56c8b9587b7d673f9a31ef1daaad4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4c5ed2-2ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634403005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403005, "uuid": "0dbc83f2-5b80-4124-ae7b-5a6689e16ad5", "comment": "Malware payload (Mirai)", "value": "b56bf3c66ce5f14e3350ee2cf176c055", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403005, "uuid": "0e6a31bf-d6f0-4f6c-800c-e68b95e71185", "comment": "Malware payload (Mirai)", "value": "f7bb5422efa931492fbfec1bcd099d5c928b4db9370d00769c42525afb822045", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403005, "uuid": "26c86483-df87-4a8e-8e03-7b8b2190f5f8", "comment": "Malware payload (Mirai)", "value": "66f9c0f797cda1da6cc64c1c517fdb0e5b21a684", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634403005, "uuid": "83b26762-1d18-4111-856e-8b1f09f3f426", "comment": "Malware payload (Mirai)", "value": "97cfcb2b911b490fa33584751504da83b54b9a3913233c00f2b8531fdd7e056bcbdafda85bb2136b4643bae9c5f195f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403005, "uuid": "2855204a-3454-46ff-8e43-aa32548c722e", "value": "T14D634BC4A593E8F4DD1507B43177EB334A77F536211AEAC7D3B8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403005, "uuid": "fe837a1b-e21e-40c4-bb02-b0fc94ed3ab8", "value": "1536:m4uQwyBcqv117K/Mn9O/kbfvxk2N5rFfEftaNGOTLaL9UPrT8y5x73QC:mBRk13jbfvxk2N5rFfE1aNGUa568ybg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634403005, "uuid": "0df00538-7d77-4d2a-97c7-5385e57cf438", "value": 70704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634403005, "uuid": "5cd48a28-0210-47fb-b587-f7a6f9010bc3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634403005, "uuid": "777e0f7c-651a-4eb1-b7c1-423025f87e48", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c619321-2e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380294, "uuid": "fb4f04ce-f221-4e2c-93ca-eab695d0120b", "comment": "Malware payload (Gafgyt)", "value": "8c4a3f9f0d69e8df4bc5cd0a202b882c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380294, "uuid": "51139aec-affe-4aed-849d-eab4022c9cf1", "comment": "Malware payload (Gafgyt)", "value": "f870d16484892a4dde82f84eaa124f094d931a3fd1fe4689c002d59da02f4f74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380294, "uuid": "7a177f7f-1b10-400b-988d-d9110029c79c", "comment": "Malware payload (Gafgyt)", "value": "7bce5aa3d763b6824d00752aefc8fd3b784a1181", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380294, "uuid": "1d4ac5ce-8c8e-4d7d-885e-141665509a92", "comment": "Malware payload (Gafgyt)", "value": "ddbb15af9f89dc467631a7fbe93d73cf56131d8965204601ceca47cd289e3def65d2afb34f40418b29e4d5505fdd2a1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380294, "uuid": "7a31359d-fd2b-4073-90d5-7773352a5a53", "value": "T114B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380294, "uuid": "ea768b8d-0101-4228-853c-b019cb30cc4b", "value": "3072:MSY+46m1qOzssjFPPKNy+AmkZrQAhPDCXFke:06mgOzJjFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380294, "uuid": "f5006d69-62b2-42e9-8caf-514351bfca15", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380294, "uuid": "62aa8de5-44e5-462a-b4c8-bb4ac3746dbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380294, "uuid": "4c5a0ffc-9ed0-409b-a2dd-646f9e73f8ee", "value": "8c4a3f9f0d69e8df4bc5cd0a202b882c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4f00b0-2e29-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1634351810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634351810, "uuid": "54d07c14-0218-48b2-9822-ecbdf922433d", "comment": "Malware payload (CryptBot)", "value": "c200e4d07007a35710e92d7dfceb0324", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634351810, "uuid": "42ac4523-f3e3-459a-8fcf-091c0ebaab74", "comment": "Malware payload (CryptBot)", "value": "f9ac3a5e47d22923cf2ba30dca03b8b16add5ce62350a60a36a5b1ca188ab158", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634351810, "uuid": "d9177c28-681a-4401-8f20-735e57a5e884", "comment": "Malware payload (CryptBot)", "value": "e42ea11e0135dba7824dd2fb58b1628e16c5fdbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634351810, "uuid": "ea07e24f-f20f-4efa-b239-31a3895ce113", "comment": "Malware payload (CryptBot)", "value": "0c0ea873a08c6cfd24a5e24c171797030ec61227bea21797fa50d08213002168c2f862d1ff406e75d137f906b31302d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634351810, "uuid": "d2daf627-b857-4f80-ab38-b6ea39bdfaaf", "value": "T15A84AF10B7A0C035F1B752F44A7A93B8B53E7AA16B2490CF22E516EE56356E0EC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634351810, "uuid": "7426908e-6713-4910-980e-d183153b8cf3", "value": "470518591ed4a5fa094199423463cb10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634351810, "uuid": "55d14782-ca3f-41f4-b09a-ae4456df1f94", "value": "6144:rwze/Y5VEXiGU84Rj/8a0nFWNS+8k/6uNVR3ltrojL:1Y5VRY4N8a+cU+8k/6MR3lxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634351810, "uuid": "b0a0cb1d-51e3-42ff-93c3-05fcbede1087", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634351810, "uuid": "14a3b49e-626e-400c-892b-fd13a7c1845e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634351810, "uuid": "b4d0b184-094e-4035-a340-90e036f4fac9", "value": "c200e4d07007a35710e92d7dfceb0324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c18432f-2e3f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634360913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360913, "uuid": "0d020238-97b7-4354-bef1-2bba9438e653", "comment": "Malware payload", "value": "ddef82db8e73cb1d95577696a5d0c2c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360913, "uuid": "a395a916-2684-428d-84a4-2ea1c5acb473", "comment": "Malware payload", "value": "f9e4b9b2bb6ce153d52a0855d2b5a93a6d1b6ccd2d8f76d44f41bca2c4c0ecf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360913, "uuid": "744f29a7-275e-44f2-941c-e76a097a85f3", "comment": "Malware payload", "value": "cda5752c821dba325ffcf56666a377495f8d9948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634360913, "uuid": "99da4489-ea38-4d7e-91b8-8174507d4d4b", "comment": "Malware payload", "value": "d197721e5b436d2ec00fc52bd0d5d49bc1ee08421d7d0693db3c2fbffb79dc1e37a120f3d03439bc8ca53c9272089cad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360913, "uuid": "0f815e4c-af24-4188-8933-15349d27a3f7", "value": "T158253A7A6CF9A677CAFE8F3E52733C1986606553708440062663FBC55891F36FB0B6A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360913, "uuid": "cab65f97-f2b7-469b-a008-f3502cf8bdc5", "value": "12288:7I6YJuaKuWOqq4RIgYedO2NKz/TTI9qRN0shRuTx/uIdbQSpn4qMmn9:s6YoaKuWOqqqqN0sh6/ukp45K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634360913, "uuid": "950b8b81-6939-41fa-8dc8-44973bd34be4", "value": 970376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634360913, "uuid": "d2de4fff-aea2-4717-a868-6a7bb8421d9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634360913, "uuid": "88b28108-00af-48c2-8246-6c5db32dd906", "value": "c7ed67c7d4fb4e6099a56c5282e19037.css", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa90f576-2e8b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634393928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393928, "uuid": "a0aacbc0-67a5-41c4-ab31-bd9e3c6f44b5", "comment": "Malware payload (NanoCore)", "value": "61ccdeae0fe7e5ad74e11b893d28b0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393928, "uuid": "6effac47-6797-4144-a8ca-d65c1d3d4f38", "comment": "Malware payload (NanoCore)", "value": "fbe720229b96efaa4082c195a6d98d43005e1f69ed031f3f9b1f8dcb2113f4d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393928, "uuid": "a62e2c9b-a70e-4c46-bc8c-1ca8263dcf39", "comment": "Malware payload (NanoCore)", "value": "6a0e803d056ba79c0da94b949d69b5d8f64fa9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634393928, "uuid": "9c4e4471-af4d-4b31-be67-6a18bb40bed5", "comment": "Malware payload (NanoCore)", "value": "eb802f8968da7d8a3ec5973d199419b43de7ecac2500b3cff6f69276ce396b2965ad10cb40773c629339ed13707f3765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393928, "uuid": "9cd94556-5893-49b9-8460-70bc7dcd0a76", "value": "T10806332023F421B2E5B577F658B3161347B73CD18A34D6EF0282957E5A12AA0953FF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393928, "uuid": "23ac4be0-cc6a-4ec1-8360-fe13398ba73e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393928, "uuid": "c052083a-3f31-4ffb-9896-f42cc5d906e7", "value": "98304:T8rtcykLHsNcxsrSg33cAUNluEtSMT8hl6ZAm9PQB:TSdkLHQos+a3VMjYMQh0m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634393928, "uuid": "ef1a4f9c-9a04-4461-b62f-9c31abe8cf8a", "value": 3764736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634393928, "uuid": "e805e8f5-7465-4b21-b0fa-2cb8f28512ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634393928, "uuid": "d6fb4762-03b0-41f5-b0a1-b1bc797a0691", "value": "Grabber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d9fb45-2e6d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634380656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380656, "uuid": "446dd4b6-88ca-4e09-8e72-eed67adf368d", "comment": "Malware payload (Gafgyt)", "value": "9692259bfb4b5bdcc509fe52b083fba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380656, "uuid": "ad6a37a5-69d3-42d6-a37d-74dec728b843", "comment": "Malware payload (Gafgyt)", "value": "fd3a90dc58231e1268b252e0cf29704a90264f46ad3c573809449e49569468f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380656, "uuid": "86b0b15e-2765-4757-b5cf-e044c0df68a1", "comment": "Malware payload (Gafgyt)", "value": "aa5599d50d109bbc2b9929750e5cfc02631624ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634380656, "uuid": "9a4f2700-3cc8-4b80-93fb-e3823da44378", "comment": "Malware payload (Gafgyt)", "value": "0f07d6223cae63f19f6fef965ce5a012bebc455cc011d48e4de5b31572e5ea6ce860fec82497f844e83445e1dea1ac91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380656, "uuid": "7e448f5e-dc6f-410b-86be-315d97cedb06", "value": "T1CF734947A9659FB3C146AAB525E759300B13F8215F0F2B89713DAAF8430F8CDB80E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380656, "uuid": "2109cf35-d3f7-4e47-9746-263306f4431f", "value": "1536:8wyVzh0fcKepZ4tyG1NaEVx7CE3yzvVrmj9VqYLe8f26e:PIzSfDeYyGl773MVmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634380656, "uuid": "03a4e3b4-bb3a-47b4-adaf-3d431eb6bc97", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634380656, "uuid": "14011cb3-a853-495f-a5b1-88c8029aa3d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634380656, "uuid": "bbe044bd-5e05-4583-a755-12c01453f51a", "value": "9692259bfb4b5bdcc509fe52b083fba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd8358-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634352939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352939, "uuid": "118720a8-a824-4f47-84e9-c3262c306a27", "comment": "Malware payload", "value": "22f5d12116ee1c11f3173f977bafc744", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352939, "uuid": "3f249534-cf23-4c49-be9f-1783d4066c1d", "comment": "Malware payload", "value": "fd4d1fc83330c5cf818e557ef882ca147ba98fee4128fe00bda07c6c2f79050a", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352939, "uuid": "a636a311-6817-43e8-aa71-5945453082d8", "comment": "Malware payload", "value": "f923b684397cb158ebd77b3d2a8e0365992867db", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352939, "uuid": "85a448db-b817-4fba-a712-0f723874fda3", "comment": "Malware payload", "value": "e0c3e2c18ca2a460da668b9f27104bd4c6f2862823201037c3347fb75c23b5409747eee29228de33fbc923710976f583", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352939, "uuid": "52ddb657-003b-40a1-822f-61682280585a", "value": "T19B15AE4BF36042FAD06F513189CBC677E3B076A91A35A72F4290D9DD2F339126F1AA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352939, "uuid": "def6e2dc-9704-446e-854a-b4bcb86a5b7e", "value": "045715ac29c84a0e47dab339e337bc06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352939, "uuid": "113ccb71-3176-4abf-ba7e-03fd7f413e15", "value": "12288:Tx1vJopzeLkTqhqeEmC7sOSafaei7fqBHf:3CzIkTgqeEVsOffasF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352939, "uuid": "4d7730c8-8a08-49b4-9d49-ea34a38963d5", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352939, "uuid": "ad810848-608b-4b80-ae8a-48205b4c7f40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352939, "uuid": "d9140a62-d486-4d24-86d1-20e4169cb1c6", "value": "48fl6271oClv7lfnOsBHvbLy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c942039-2e2c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634352914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352914, "uuid": "a2ff4775-6a8f-452f-a6b0-a40f9cad4322", "comment": "Malware payload (RedLineStealer)", "value": "47e59166e719f7e4641e5462be5fdc80", "object_relation": "md5", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352914, "uuid": "396378b5-53b3-401b-93e8-cb1a8717d9d1", "comment": "Malware payload (RedLineStealer)", "value": "fe622c4801737dede008dfecf2bcf48316f0adebbc080d27a2664ee8b606415c", "object_relation": "sha256", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352914, "uuid": "fd1ccae2-d1ee-4b51-b126-fd294aede272", "comment": "Malware payload (RedLineStealer)", "value": "08e9365dc59124e24c193f636b11ae8fc27c28c5", "object_relation": "sha1", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634352914, "uuid": "a3b46eeb-1aa8-46a0-a013-3cce6c28f607", "comment": "Malware payload (RedLineStealer)", "value": "447b99bc18cc93a794f2c42ef6944d4a306f9dd1898f38a865da96714421570bbbf8ed6ed045d1f50a0b2a4725d92212", "object_relation": "sha3-384", "Tag": [ { "name": "ETLabsKim", "colour": "#E8ED19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352914, "uuid": "006473be-fda7-43b8-b544-daee9049276c", "value": "T1EA84AE10B7A0C034F1F756F44AB69378B93E7AA0AB2854CF22D526ED5A746E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352914, "uuid": "a7a57ba4-e11e-462b-84c4-d37eda674c17", "value": "8d9ee1d37ce0771b137ef02c8f52b4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352914, "uuid": "254db8f4-7230-4526-8f31-664ec62fbc09", "value": "12288:Lh8fQgjf5hisJp1uIScRxQbGHu9DOk+y:Lh5Ef51JjzS8HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634352914, "uuid": "214f8697-5862-49e1-b8b5-75c886b208be", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634352914, "uuid": "568f4046-2381-48c5-baf9-fd1751d15b7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634352914, "uuid": "013f86a6-c45f-4b88-b34f-5bcd0936b60c", "value": "5yyNVbMOOjT1pLcNXc3B1EPt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a98124-2e64-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634376927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376927, "uuid": "360a6033-d2c2-42a2-b717-15a44eb050c9", "comment": "Malware payload (Gafgyt)", "value": "383a4b2b4465df5e7a66b80a6b0dc23d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376927, "uuid": "9d49e92f-4acb-48ed-a0e9-31a140c29117", "comment": "Malware payload (Gafgyt)", "value": "ff55c82d39476e4d47137ef8a5f2ded8db1bf5efc270cc09bd23ff53d7e01b8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376927, "uuid": "ba22e2c9-8e99-41c2-868a-ee6dbc5fd17b", "comment": "Malware payload (Gafgyt)", "value": "c0a0b08e9269eeb1cf470ec6cdbbd661015fede9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634376927, "uuid": "599c6843-e93e-4c79-8700-a55468ceb923", "comment": "Malware payload (Gafgyt)", "value": "1e8bd7ca931bd62a2ca82c3976d6c4c8a1376b7745186a902cfbca428c6e116e51ebd7499cd466d5f8015ad31ac5a54d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376927, "uuid": "49e98bfe-1448-437a-94e6-81cd54836289", "value": "T13BF3DA1B77618EB3D81ECD33029A1601108DD9AB45D93BBBF6B4E958EB6684F05E3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376927, "uuid": "3a2e463d-d633-4edc-8ed0-aafdfbca0c2c", "value": "3072:8AV0q6rmC7JketJ8add9QzhsjgHnfXYdfi+FqLwZi+LGI:8AVsrjJketJ8addQyQXYdfi+FqLwU+Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634376927, "uuid": "00e947ff-0158-416a-88cc-23f8225be6f3", "value": 171053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634376927, "uuid": "f59f7c42-5ada-44c6-b7cc-70ea3902265e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634376927, "uuid": "cfa413a1-4d79-4c24-a241-9e3826f566a7", "value": "383a4b2b4465df5e7a66b80a6b0dc23d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed36b24b-2ec4-11ec-843c-42010a9c0014", "comment": "Malware payload (Glupteba)", "timestamp": 1634418386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634418386, "uuid": "e4175d4a-7ac7-40c3-87e1-20b6bba56dce", "comment": "Malware payload (Glupteba)", "value": "63f71301c182f0bf0dccd90e286ebadd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634418386, "uuid": "95e120ad-b441-4073-8903-c7ec67b767ed", "comment": "Malware payload (Glupteba)", "value": "ff95183ce9226efec5973af473cc08db46f82d0e10396dc3f8fed138c73a2f8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634418386, "uuid": "b4283369-c440-4bce-986e-13444c409ef0", "comment": "Malware payload (Glupteba)", "value": "a8693f1c66d22015f294d02be630d743944603bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634418386, "uuid": "6e3e11e6-223e-4726-b6e5-46e03f79e9e1", "comment": "Malware payload (Glupteba)", "value": "381c41507793abbee01a3c3c0976ad83de854e7500b049e5646d9451f23207ae0857ca1f77bf10a3a5df317babcd2b79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634418386, "uuid": "b597281d-9bc1-4f3c-a5a2-7d3891dc90ab", "value": "T1EDA65C50FDDB50F9EB07957085E7523F6330920A8335DECBC6546EA6F81B6E20A37229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634418386, "uuid": "a2c83dff-f2e9-4bc2-858c-0376afd8bd1f", "value": "d90d8c7812aec8da0fa173afa1293ab2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634418386, "uuid": "b5e90edf-d406-4c1a-b779-ea8f9486d78d", "value": "98304:XogaSINe+21SS3JUCRi/QaYBbNJyNrkVqR/RFO/IiDs+dyvVeJ4TfK/Gq/i:XogLINEZ9+QasbNJqkeOwiDsweYJ9/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634418386, "uuid": "c6ae0d49-36be-43ca-9b89-8b5db3ed68a5", "value": 10224640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634418386, "uuid": "8f219fd3-1063-4501-b6fc-9831a8011562", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634418386, "uuid": "6d31a5e3-a809-48cb-b639-39bb5ba8b3a3", "value": "63f71301c182f0bf0dccd90e286ebadd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }